# LDAP hostname verification

**URL:** <https://discuss.elastic.co/t/ldap-hostname-verification/93614>\
**Category:** Elasticsearch\
**Created:** [July 18, 2017, 3:23pm UTC](https://discuss.elastic.co/t/ldap-hostname-verification/93614 "2017-07-18T15:23:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\
**Post date:** [July 18, 2017, 3:23pm UTC](https://discuss.elastic.co/t/ldap-hostname-verification/93614/1 "2017-07-18T15:23:21Z")

</div>

Hi,

I'm trying to configure authentication through Active Directory.

Here is my configuration:

```
xpack:
  security:
authc:
  realms:
    active_directory:
      type: active_directory
      order: 0
      domain_name: ep
      url: ldaps://adalias.domain, ldaps://adalias2.domain
      ssl:
        certificate_authorities: ["x-pack/rootca.pem"]
      load_balance:
        type: "failover"

```

My problem is that adalias.domain is an alias (with loadbalancing behind it), and this configuration doesn't work until I replace it with one of the real server names behind it ("'Hostname  
verification failed because the expected hostname 'adalias'  
was not found in peer certificate ").

So...finally it works, but not exactly as expected.  
I saw that there is a hostname verification that can be disabled...but I can't find this parameter in the docs.

Can you help me with that?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 19, 2017, 12:39am UTC](https://discuss.elastic.co/t/ldap-hostname-verification/93614/2 "2017-07-19T00:39:05Z")

</div>

> [@](#):
>
> I can't find this parameter in the docs.

You're looking for `ssl.verification_mode` in the [security settings](https://www.elastic.co/guide/en/elasticsearch/reference/5.5/security-settings.html#ref-ldap-settingsl) docs.

You want to set that to `certificate`

---

<div class="post-metadata">

**Author:** ![Cornoualis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cornoualis/32/23246_2.png) [@Cornoualis](https://discuss.elastic.co/u/Cornoualis)\
**Post date:** [July 24, 2017, 10:24am UTC](https://discuss.elastic.co/t/ldap-hostname-verification/93614/3 "2017-07-24T10:24:12Z")

</div>

Thanks a lot Tim!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2017, 10:24am UTC](https://discuss.elastic.co/t/ldap-hostname-verification/93614/4 "2017-08-21T10:24:15Z")

</div>

Closed on August 21, 2017, 10:24am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.