# FSCrawler && SSL && SANs

**URL:** <https://discuss.elastic.co/t/fscrawler-ssl-sans/314263>\
**Category:** Elasticsearch\
**Created:** [September 13, 2022, 8:22am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263 "2022-09-13T08:22:05Z")\
**Posts on this page:** 10\
**Page:** 2

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 20, 2022, 9:17am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/21 "2022-09-20T09:17:49Z")

</div>

This is not related. You can ignore this warning.

Are you still using the SNAPSHOT version?  
This message should not be in the SNAPSHOT version I think.

---

<div class="post-metadata">

**Author:** ![cheshirecat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheshirecat/32/109532_2.png) [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\
**Post date:** [September 20, 2022, 9:21am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/22 "2022-09-20T09:21:12Z")

</div>

Nope. This is form 'standard' version.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 20, 2022, 3:14pm UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/23 "2022-09-20T15:14:44Z")

</div>

Could you try the latest SNAPSHOT instead. The 2.9 is super old actually.

---

<div class="post-metadata">

**Author:** ![macb74](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/macb74/32/111230_2.png) [@macb74](https://discuss.elastic.co/u/macb74)\
**Post date:** [September 25, 2022, 4:25pm UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/24 "2022-09-25T16:25:53Z")

</div>

Hi, I have the same issue. Build from grom git yesterday. Seems like ssl\_verification is ignored.

`Can not execute GET https://elasticsearch:9200/ : No subject alternative DNS name matching crawler-elasticsearch found.`

My certificates name of url is different, because i am running in container and name changes on each startup.

Is seems like this issue is just when name of url and certificate does not match. On a local installation, where name matches, but certificate is not trusted, it works.

---

<div class="post-metadata">

**Author:** ![macb74](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/macb74/32/111230_2.png) [@macb74](https://discuss.elastic.co/u/macb74)\
**Post date:** [September 25, 2022, 5:54pm UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/25 "2022-09-25T17:54:10Z")

</div>

Hi, I think I fixed is with adding this to ElasticsearchClient (starting in line 168).

```auto
                HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
                HostnameVerifier hv = new HostnameVerifier() {
                    public boolean verify(String urlHostName, SSLSession session) {
                        if (!urlHostName.equalsIgnoreCase(session.getPeerHost())) {
                            System.out.println("Warning: URL host '" + urlHostName + "' is different to SSLSession host '" + session.getPeerHost() + "'.");
                        }
                        return true;
                    }
                };
                HttpsURLConnection.setDefaultHostnameVerifier(hv);

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/4/f4acd1670775ed04f70b161ecc3a01f62da70775.png)

don't know how to contribute, so I send it in this was. Please merge it into your code, if you are fine with it. This now not only checkt if a cert is valid, it also ignores when cn is not matching.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 25, 2022, 7:37pm UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/26 "2022-09-25T19:37:47Z")

</div>

Thanks a lot @macb74.

Could you tell me how I can reproduce the problem so I can make sure that your proposal for a fix actually fixes the problem without side effects?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [September 25, 2022, 7:48pm UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/27 "2022-09-25T19:48:50Z")

</div>

Based on your proposal, I opened:

> <https://github.com/dadoonet/fscrawler/pull/1505>

---

<div class="post-metadata">

**Author:** ![macb74](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/macb74/32/111230_2.png) [@macb74](https://discuss.elastic.co/u/macb74)\
**Post date:** [September 25, 2022, 8:06pm UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/28 "2022-09-25T20:06:32Z")

</div>

Your code right now, just ignores a untrusted certificate, when ssl\_verification is set to false.

My additional code now also ignores if the name of the url in the certificete does not match the url elasticsearch is listening on.

e.g. the SSL Certificate is for cn: [my-first-elasticsearch.mydomain.com](http://my-first-elasticsearch.mydomain.com) and my URL for Elasticsearch is [https://my-second-elasticsearch.mydomain.com](https://my-second-elasticsearch.mydomain.com). You see, the installed certificate at elasticsearch host does not match to the hosts name.

In my environment this happened, because I started elasticsearch in docker container first time. By autoconfiguration the ssl certificates have been generated. Now the name of host changed and certificate does not longer match hostname. It is not a good idea for production, but happens in my devenvironment from time to time.

---

<div class="post-metadata">

**Author:** ![cheshirecat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheshirecat/32/109532_2.png) [@cheshirecat](https://discuss.elastic.co/u/cheshirecat)\
**Post date:** [October 5, 2022, 8:27am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/29 "2022-10-05T08:27:52Z")

</div>

Hello,  
Could you please test your code with `--restart` switch?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 2, 2022, 8:28am UTC](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263/30 "2022-11-02T08:28:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/fscrawler-ssl-sans/314263.md?page=1)