# Host name does not match the certificate

**URL:** <https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 20, 2019, 7:38am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618 "2019-06-20T07:38:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Post date:** [June 20, 2019, 7:38am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618/1 "2019-06-20T07:38:57Z")

</div>

Hi everyone,

I use command './bin/elasticsearch-certutil cert --ca-cert config/ca/ca.crt --ca-key config/ca/ca.key ' to create a p12 file.

This file doesn't include any IP/Hostname information, so when I connect to ES cluster with transportclient, java code would be:  
builder.put("xpack.security.transport.ssl.verification\_mode", "certificate");

And my question is:  
If I use RestHighLevelClient instead of Transportclient, what should the code be?

My JAVA code -  
KeyStore truststore = KeyStore.getInstance("jks");  
try (InputStream is = new FileInputStream("/mypath/elastic-certificates.p12")) {  
truststore.load(is, "123456".toCharArray());  
}  
SSLContextBuilder sslBuilder = SSLContexts.custom()  
.loadTrustMaterial(truststore, null);  
final SSLContext sslContext = sslBuilder.build();  
RestClientBuilder builder = RestClient.builder(  
new HttpHost("172.16.3.85", 9200, "https"))  
.setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {  
@Override  
public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) {  
return httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider).setSSLContext(sslContext);  
}  
});

And I got error -  
java.io.IOException: Host name '172.16.3.85' does not match the certificate subject provided by the peer (CN=instance)

I don't know much about CA, I think the CN is the hostname(I think "instance" is default valueIn because in my case, the hostname should be "hadoop-5"). but my ES cluster hava 3 nodes(hadoop-5 hadoop-6 hadoop-7), hadoop-5 is one of these, should I set CN to "hadoop-5,hadoop-6,hadoop-7"?

How could I do to ignore IP/Hostname，only use certificate to verification user.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 21, 2019, 2:51am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618/2 "2019-06-21T02:51:21Z")

</div>

You need to disable hostname verification your in `HttpAsyncClientBuilder`:

```auto
public HttpAsyncClientBuilder customizeHttpClient(HttpAsyncClientBuilder httpClientBuilder) {
  return httpClientBuilder
         .setDefaultCredentialsProvider(credentialsProvider)
         .setSSLContext(sslContext)
         .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
}

```

---

<div class="post-metadata">

**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Post date:** [June 23, 2019, 2:49am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618/3 "2019-06-23T02:49:04Z")

</div>

Hi @TimV，  
Your answer solved my problem， Thank you very much！

Best regards，  
yeziblo

---

<div class="post-metadata">

**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\
**Post date:** [July 8, 2019, 9:10am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618/4 "2019-07-08T09:10:37Z")

</div>

HI @TimV,  
If I use jdbc:es:// to connection to ES, How can I set "NoopHostnameVerifier.INSTANCE" in jdbc url?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 9, 2019, 9:21am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618/5 "2019-07-09T09:21:06Z")

</div>

At this point you're making life harder and harder for yourself.

You really should just use a certificate that includes the DNS name(s) of your node(s).  
Disabling hostname verification in every client you ever want to use is the wrong solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2019, 9:21am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618/6 "2019-08-06T09:21:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.