# Host name does not match the certificate

**URL:** <https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 5, 2021, 2:26pm UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242 "2021-04-05T14:26:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ajith\_07](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Ajith\_07](https://discuss.elastic.co/u/Ajith_07)\
**Post date:** [April 5, 2021, 2:26pm UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242/1 "2021-04-05T14:26:39Z")

</div>

Hi,

I am facing Host name does not match the certificate issue in ES. I tried checking in ES forum and some has asked to disable the CN name check at code level but in the same thread we also see that its not recommended solution. I have pasted the error below, Please help if you have found any other solution otherthan disabling the hostname verification at code level. I have 2 nodes in a cluster in Elastic Search and connecting from JBoss 7.1.

Please find the url for which I referred,

> [@Host name does not match the certificate](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/186618):
>
> Hi everyone, I use command './bin/elasticsearch-certutil cert --ca-cert config/ca/ca.crt --ca-key config/ca/ca.key ' to create a p12 file. This file doesn't include any IP/Hostname information, so when I connect to ES cluster with transportclient, java code would be: builder.put("xpack.security.transport.ssl.verification\_mode", "certificate"); And my question is: If I use RestHighLevelClient instead of Transportclient, what should the code be? My JAVA code - KeyStore truststore = KeyStore…

Error:  
INFO : 24 Mar 2021 11:32:34,094 org.ifc.search.controller.SearchController - Ops!  
java.io.IOException: Host name '[xyz.org](http://xyz.org)' does not match the certificate subject provided by the peer ([CN=xyz.org](http://CN=xyz.org))

Thanks,  
Ajith

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [April 7, 2021, 6:38am UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242/2 "2021-04-07T06:38:56Z")

</div>

When you generate your certificates, you should set the appropriate hostname.  
See the `--dns` option to [certutil](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html)

---

<div class="post-metadata">

**Author:** ![Ajith\_07](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Ajith\_07](https://discuss.elastic.co/u/Ajith_07)\
**Post date:** [April 9, 2021, 6:46pm UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242/3 "2021-04-09T18:46:46Z")

</div>

Hi Tim,

We have the SAN names in the CSR we generated and using that .csr we have created an internal certificate. PFA screenshot.

Thanks,

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af03e16f2a810006f0b14c982bf78b644162cb34.png)  
Ajith

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2021, 6:47pm UTC](https://discuss.elastic.co/t/host-name-does-not-match-the-certificate/269242/4 "2021-05-07T18:47:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.