# How to change certificate's CN **URL:** \ **Category:** Elasticsearch\ **Created:** [July 8, 2019, 9:37am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317 "2019-07-08T09:37:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Post date:** [July 8, 2019, 9:37am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317/1 "2019-07-08T09:37:59Z")
Hi everyone, I generated the CA and Certs as suggested by the docs: bin/elasticsearch-certutil ca bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 I found that the CN of the certificate is "instance". My hostname is not "instance", So I have to add content to the code: setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE) My question is: How to change the CN of certificate? 1. I tried to use the following command: ./bin/elasticsearch-certutil cert --ca config/cert/elastic-ca.p12 --ca-dn "CN=hadoop-1" And I get a error: ERROR: Option(s) [ca-dn] are unavailable given other options on the command line 1. I tried to use the following command: ./bin/elasticsearch-certutil cert --ca config/cert/elastic-ca.p12 --name hadoop-1 and the certificate info: Bag Attributes friendlyName: hadoop-1 subject=/CN=hadoop-1 issuer=/CN=Elastic Certificate Tool Autogenerated CA It seems that CN has been changed, but my program still got errors: javax.net.ssl.SSLPeerUnverifiedException: Host name 'hadoop-1' does not match the certificate subject provided by the peer (CN=instance) Thanks and Best regards! ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 9, 2019, 9:19am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317/2 "2019-07-09T09:19:15Z")
> [@yeziblo](#): > > I found that the CN of the certificate is "instance". > > My hostname is not "instance", So I have to add content to the code: That is not correct. You don't want to set the `CN` to your hostname, you want add a DNS tagged, Subject Alternative Name to your certificate. The [certutil documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html) describes the `--dns` option that you should use. ---
**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Post date:** [July 9, 2019, 9:31am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317/3 "2019-07-09T09:31:23Z")
Hi @TimV, I know what the problem is, I created a certificate using "./bin/elasticsearch-certutil cert --ca config/cert/elastic-ca.p12" command, then put it in the /es/config directory, In this case, no matter how I set up my DNS in cert command for other certificate , it does not works. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 9, 2019, 11:21am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317/4 "2019-07-09T11:21:29Z")
I don't follow. You say you know what the problem is, but that it does not work. Can you provide the exact commands that you are running, and the exact circumstances under which you get the error? ---
**Author:** ![yeziblo](https://avatars.discourse-cdn.com/v4/letter/y/74df32/32.png) [@yeziblo](https://discuss.elastic.co/u/yeziblo)\ **Post date:** [July 10, 2019, 6:30am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317/5 "2019-07-10T06:30:47Z")
Sorry, I didn't make myself clear. I created a certificate using "./bin/elasticsearch-certutil cert --ca config/cert/elastic-ca.p12" command( without --dns ), then put it in the /es/config directory. After that, I created another certificate using "./bin/elasticsearch-certutil cert --ca config/cert/elastic-ca.p12 --dns ", this certificate was used by my application to connect to ES. Because of the first certificate in /es/config/ directory did not have dns, my application could not connect to ES even though the app's certificate have dns. My solution is: Replace the certificate without dns in /es/config/ directory with a new certificate that have dns. And then my application can connect to ES. Sorry, I don't speak English very well. Thanks for your patience and best regards. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 7, 2019, 6:30am UTC](https://discuss.elastic.co/t/how-to-change-certificates-cn/189317/6 "2019-08-07T06:30:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.