# Http\_poller Host name '192.168.1.35' does not match the certificate subject provided by the peer **URL:** \ **Category:** Logstash\ **Created:** [March 22, 2018, 6:31am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111 "2018-03-22T06:31:02Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [March 22, 2018, 6:31am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/1 "2018-03-22T06:31:03Z")
Hi, I'm struggling to get the http\_poller working with a piece of equipment running a self signed cert. I've created the cert with the following command `openssl s_client -showcerts -connect 192.168.1.35:443 /dev/null|openssl x509 -outform PEM > downloaded_cert.pem; keytool -import -alias test -file downloaded_cert.pem -keystore downloaded_truststore.jks` Logstash generates the following error `"error" => "Host name '192.168.1.35' does not match the certificate subject provided by the peer (CN=*.device.maker.com, OU=maker, O=\"maker, INC.\", L=somewhere, ST=somewhere, C=US)"` I know very little about certificates but it looks like the error is caused by the device having 192.168.1.35 assigned as its IP but the cert having a wildcard for \*.device.maker.com? Is there any way to work around this? Changing the cert is not possible. `curl -k` works fine but it seems such an option is not available for the http\_poller. ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [March 22, 2018, 7:05am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/2 "2018-03-22T07:05:20Z")
Can you connect to the device via a domain name that matches? A potential workaround could be to add an entry in your machine's host file pointing to that IP if you don't have a real DNS entry for it. The http\_poller input plugin does not presently have an option to ignore certificate validation. ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [March 22, 2018, 7:12am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/3 "2018-03-22T07:12:52Z")
Hi, I did try adding `192.168.1.35 device.maker.com` to the hosts file of the device running logstash but that gave me the same error. Maybe I did something wrong, I'll give that another try. ---
**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\ **Post date:** [March 22, 2018, 7:15am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/4 "2018-03-22T07:15:14Z")
Is the input configured to connect by domain name, or by IP? ---
**Author:** ![wwalker](https://avatars.discourse-cdn.com/v4/letter/w/43a26b/32.png) [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Post date:** [March 22, 2018, 1:01pm UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/5 "2018-03-22T13:01:02Z")
> [@Sjaak01](#): > > Hi, > > I'm struggling to get the http\_poller working with a piece of equipment running a self signed cert. I've created the cert with the following command > `openssl s_client -showcerts -connect 192.168.1.35:443 /dev/null|openssl x509 -outform PEM > downloaded_cert.pem; keytool -import -alias test -file downloaded_cert.pem -keystore downloaded_truststore.jks` > > Logstash generates the following error > ` "error" => "Host name '192.168.1.35' does not match the certificate subject provided by the peer (CN=*.device.maker.com, OU=maker, O=\"maker, INC.\", L=somewhere, ST=somewhere, C=US)"` > > I know very little about certificates but it looks like the error is caused by the device having 192.168.1.35 assigned as its IP but the cert having a wildcard for \*.device.maker.com? > > Is there any way to work around this? Changing the cert is not possible. `curl -k` works fine but it seems such an option is not available for the http\_poller. Generally, SSL certs contain hostnames, not IPs. Try using the hostname of the device, may not work though. I haven't done much of anything with Java keystores so I don't quite know where this error is at in the process but you probably need to import the self-signed cert into the Java keystore. ---
**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\ **Post date:** [March 23, 2018, 12:55am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/6 "2018-03-23T00:55:32Z")
This was the part I forgot. Still had the config pointing to the IP instead of the domain. It's all working now 🙂 I really like this plugin, very powerful for my use case. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 20, 2018, 12:56am UTC](https://discuss.elastic.co/t/http-poller-host-name-192-168-1-35-does-not-match-the-certificate-subject-provided-by-the-peer/125111/7 "2018-04-20T00:56:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.