Elasticsearch ignores the `xpack.security.transport.ssl.certificate_authorities` parameter

gimpastic · October 2, 2020, 6:31pm

Hi, It seems like there is some misleading or a bug with the parameters: key, certificate, certificate_authorities
Elasticsearch ignores the xpack.security.transport.ssl.certificate_authorities parameter
The Elasticsearch version is 7.9.2

The Elasticsearch Cluster log output:

[2020-10-02T16:20:17,967][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [elasticsearch-02.example.local] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=/10.XXX.XXX.42:43602, remoteAddress=elasticsearch-01.example.local/10.XXX.XXX.41:9300}
[2020-10-02T16:20:18,967][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [elasticsearch-02.example.local] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=/10.XXX.XXX.42:43604, remoteAddress=elasticsearch-01.example.local/10.XXX.XXX.41:9300}
[2020-10-02T16:20:19,967][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [elasticsearch-02.example.local] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=/10.XXX.XXX.42:43606, remoteAddress=elasticsearch-01.example.local/10.XXX.XXX.41:9300}
[2020-10-02T16:20:20,968][WARN ][o.e.x.c.s.t.n.SecurityNetty4Transport] [elasticsearch-02.example.local] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress=/10.XXX.XXX.42:43608, remoteAddress=elasticsearch-01.example.local/10.XXX.XXX.41:9300}

elasticsearch-02.example.local tries to connect to elasticsearch-01.example.local close the connection becouse the client don't trust this server's certificate.

3x nodes (1 master, 2 data) TLS configuration is:

xpack.security.enabled: true

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: "certificate"
xpack.security.transport.ssl.key: "/etc/elasticsearch/certs/elasticsearch.example.local.key"
xpack.security.transport.ssl.certificate: "/etc/elasticsearch/certs/elasticsearch.example.local.crt"
xpack.security.transport.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca.crt" ]

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: "/etc/elasticsearch/certs/elasticsearch.example.local.key"
xpack.security.http.ssl.certificate: "/etc/elasticsearch/certs/elasticsearch.example.local.crt"
xpack.security.http.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca.crt" ]

elasticsearch.example.local.crt - PEM certificate is the same for all 3x servers, has CN = elasticsearch.example.local an SAN (subject alternative name) for all cluster domains: DNS:elasticsearch-01.example.local, DNS:elasticsearch-02.example.local, DNS:elasticsearch-02.example.local
elasticsearch.example.local.key - The key for the certificate elasticsearch.example.local.crt
ca.crt - The Self Signed CA Certificate used to create the certificate elasticsearch.example.local.crt
Conections between servers goes by DNS host names and not by IP (you can see it form the cluster.log output)

OpenSSL tests

#Test command with CA:
openssl s_client -connect elasticsearch-02.example.local:9300 -CAfile /etc/elasticsearch/certs/ca.crt

#Results:
depth=1
verify return:1
depth=0 CN = elasticsearch.example.local
verify return:1

#Test command without CA:
openssl s_client -connect elasticsearch-02.example.local:9300

#Results:
depth=0 CN = elasticsearch.example.local
verify error:num=20:unable to get local issuer certificate
verify return:1

The tests with OpenSSL show that the TLS and the DNS configurations are ok
TLS works with certificates and custom self signed CA with no issues
But Elasticsearch ignores the certificate_authorities parameter and won't verify the certificate using custom CA

CA, Certificate + Key (The files were generated for the post, and not in use of any environemntes)

Example CA:

Example Certificate:

Example Certificate Key:

Please, show where I have a mistake or confirm if it's a bug in the Elasticserach TLS transport (Elasticsearch ignores the xpack.security.transport.ssl.certificate_authorities: [ "/etc/elasticsearch/certs/ca.crt" ] parameter and won’t verify the certificate using the custom CA)

gimpastic · October 3, 2020, 3:36pm

I have found a solution:
The server certificate (in my case: elasticsearch.example.local.crt) should have extended key usage: serverAuth and clientAuth but in my certificates I have used only serverAuth

system · October 31, 2020, 3:36pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.