# Enabling shield and ssl on node with multiple elasticsearch instances **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [April 7, 2016, 3:11pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706 "2016-04-07T15:11:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![peppetrick](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@peppetrick](https://discuss.elastic.co/u/peppetrick)\ **Post date:** [April 7, 2016, 3:11pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/1 "2016-04-07T15:11:57Z")
Hi We have a problem with setting SSL and shield on a cluster. The cluster is done by 3 machine with two elastic istance each, it is a test environment that reproduce the deployment env in terms of elastic nodes. The istances on the same node use the same IP address so I used fqdn to differentiate istances. The problem si that the software (java ssl/tls library i was wondering) use the firts IP-fqdn resolution find in the host file of the server. for example one server has two istances with the following fqdn **el-ro1.logga.loca** l and **el-wn1.logga.local** in the file host they are resolved with the same IP address. So when es-ro1 try to contact es-wn1 on the same machine I see the following stack trace I tried to use fqdn in discovery.zen.ping.unicast.hosts but nothing change.. Any hint? Regards * * * [2016-04-07 16:31:32,785][ERROR][shield.transport.netty] [el-ro1] SSL/TLS handshake failed, closing channel: General SSLEngine problem [2016-04-07 16:31:32,789][WARN][shield.transport.netty] **[el-ro1] exception caught on transport layer [[id: 0x1c433071, /10.13.195.187:35433 :\> el-ro1.lo** **gga.local/10.13.195.187:9300]], closing connection** javax.net.ssl.SSLHandshakeException: General SSLEngine problem at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431) ......... at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ........... at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255) ... 18 more **Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching el-ro1.logga.local found.** at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:204) at sun.security.util.HostnameChecker.match(HostnameChecker.java:95) ..... at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496) ... 26 more [2016-04-07 16:31:34,265][ERROR][shield.transport.netty] [el-ro1] SSL/TLS handshake failed, closing channel: General SSLEngine problem ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [April 7, 2016, 3:27pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/2 "2016-04-07T15:27:31Z")
I think you need to use the FQDN in all network settings. It sounds like you specify at least the bound address, do you also specify a publish address? If you set `network.host`, then change that to the FQDN in addition to using FQDN in the unicast hosts list. ---
**Author:** ![peppetrick](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@peppetrick](https://discuss.elastic.co/u/peppetrick)\ **Post date:** [April 7, 2016, 3:33pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/3 "2016-04-07T15:33:48Z")
This is my config for network parameters **network.host: 0.0.0.0** **network.publish\_host: el-ro1.logga.local** Shoud I set **network.host: el-ro1.logga.local** too? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [April 7, 2016, 4:04pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/4 "2016-04-07T16:04:48Z")
I would try setting network.host to the FQDN on all the nodes and see if it helps. I should have asked this earlier, do you use the FQDN as a SAN in your certificates? ---
**Author:** ![peppetrick](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@peppetrick](https://discuss.elastic.co/u/peppetrick)\ **Post date:** [April 8, 2016, 8:48am UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/5 "2016-04-08T08:48:48Z")
Unfortunately it does not solve the problem ... I used the following command for the certreq keytool -certreq -alias el-wn1 -keystore el-wn1.jks -file el-wn1.csr -keyalg rsa -ext san=dns:el-wn1.logga.local,ip:10.13.195.187 keytool -certreq -alias el-ro1 -keystore el-ro1.jks -file el-ro1.csr -keyalg rsa -ext san=dns:el-ro1.logga.local,ip:10.13.195.187 Should I use only IP adddress in this case ? ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [April 12, 2016, 10:48am UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/6 "2016-04-12T10:48:51Z")
IP only may be the best choice. See the documentation on `shield.ssl.hostname_verification.resolve_name` [here](https://www.elastic.co/guide/en/shield/current/shield-settings.html) ---
**Author:** ![peppetrick](https://avatars.discourse-cdn.com/v4/letter/p/3d9bf3/32.png) [@peppetrick](https://discuss.elastic.co/u/peppetrick)\ **Post date:** [April 13, 2016, 1:29pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/7 "2016-04-13T13:29:12Z")
Thanks Jay Setting shield.ssl.hostname\_verification.resolve\_name: false Solved the issue.. Thanks for your help Giuseppe ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:45pm UTC](https://discuss.elastic.co/t/enabling-shield-and-ssl-on-node-with-multiple-elasticsearch-instances/46706/8 "2017-07-06T13:45:24Z")