# Elasticsearch SSL/TLS verification mode full **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [May 24, 2019, 11:32am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633 "2019-05-24T11:32:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![safderali5](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@safderali5](https://discuss.elastic.co/u/safderali5)\ **Post date:** [May 24, 2019, 11:32am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633/1 "2019-05-24T11:32:29Z")
I enabled TLS on elasticsearch using self signed certificates. The certificate include DNS entries containing host names of all elasticsearch nodes. When I start elasticsearch I get exception: `No subject alternative names matching IP address xxx.xxx.xxx.xxx found` I wonder why it using IP address to validate. I have looked on this link and searched other pages, couldn't find any reason for this [https://www.elastic.co/guide/en/elastic-stack-overview/6.8/trb-security-sslhandshake.html](https://www.elastic.co/guide/en/elastic-stack-overview/6.8/trb-security-sslhandshake.html) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [May 25, 2019, 2:02am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633/2 "2019-05-25T02:02:37Z")
What do you have set for `network.host` in your elasticsearch.yml? Elasticsearch discovers the other nodes in a cluster by connecting to the seed nodes, adding themselves to the cluster, and asking for the list of node members. It's that last bit that matters the most - when the list of nodes is retrieved it includes a network address for each node. If that's an IP, then the nodes will connect by IP and the TLS certificate needs to include the IP address. If that list includes hostnames instead, then we will connect by hostname, and the certificate needs a DNS name. You can set `network.host` to a hostname, or if you need it to be an IP, you can override how it is published in the cluster list by setting `network.publish_host`. ---
**Author:** ![safderali5](https://avatars.discourse-cdn.com/v4/letter/s/8edcca/32.png) [@safderali5](https://discuss.elastic.co/u/safderali5)\ **Post date:** [May 27, 2019, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633/3 "2019-05-27T07:45:42Z")
Thanks @TimV for explanation. Now it's more clear why it was working this way. The setting in elastisearch.yml was `network.host: _site_` and that I think will use IP address to publish host. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 24, 2019, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-ssl-tls-verification-mode-full/182633/4 "2019-06-24T07:45:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.