Host name does not match the certificate

[Ajith_07 (Ajith Kumar Srinivas)]

Hi,

I am facing Host name does not match the certificate issue in ES. I tried checking in ES forum and some has asked to disable the CN name check at code level but in the same thread we also see that its not recommended solution. I have pasted the error below, Please help if you have found any other solution otherthan disabling the hostname verification at code level. I have 2 nodes in a cluster in Elastic Search and connecting from JBoss 7.1.

Please find the url for which I referred,

Host name does not match the certificate

Hi everyone, I use command './bin/elasticsearch-certutil cert --ca-cert config/ca/ca.crt --ca-key config/ca/ca.key ' to create a p12 file. This file doesn't include any IP/Hostname information, so when I connect to ES cluster with transportclient, java code would be: builder.put("xpack.security.transport.ssl.verification_mode", "certificate"); And my question is: If I use RestHighLevelClient instead of Transportclient, what should the code be? My JAVA code - KeyStore truststore = KeyStore…

Error:
INFO : 24 Mar 2021 11:32:34,094 org.ifc.search.controller.SearchController - Ops!
java.io.IOException: Host name 'xyz.org' does not match the certificate subject provided by the peer (CN=xyz.org)

Thanks,
Ajith

[TimV (Tim Vernum)]

When you generate your certificates, you should set the appropriate hostname.
See the --dns option to certutil

[Ajith_07 (Ajith Kumar Srinivas)]

Hi Tim,

We have the SAN names in the CSR we generated and using that .csr we have created an internal certificate. PFA screenshot.

Thanks,

Ajith