# Multi-node cluster setup-passwords fails **URL:** \ **Category:** Elasticsearch\ **Created:** [May 18, 2018, 6:03pm UTC](https://discuss.elastic.co/t/multi-node-cluster-setup-passwords-fails/132524 "2018-05-18T18:03:00Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![KeninHouston](https://avatars.discourse-cdn.com/v4/letter/k/54ee81/32.png) [@KeninHouston](https://discuss.elastic.co/u/KeninHouston)\ **Post date:** [May 18, 2018, 6:03pm UTC](https://discuss.elastic.co/t/multi-node-cluster-setup-passwords-fails/132524/1 "2018-05-18T18:03:00Z")
Hi, I have setup a multi-node elasticsearch cluster successfully and turned on TLS to encrypt traffic between the nodes and also into the cluster. I am using an external load balancer which resolves to a domain of, say [domain.com](http://domain.com) I used the certutil tool on one of the nodes to generate a p12 certificate authority and certificate. I then copied the certificate to all of the other nodes. All of the nodes start successfully and I can see that they are talking to each other correctly. When I try and set the passwords for the built-in users, I get an error: /usr/share/elasticsearch/bin/x-pack/setup-passwords auto -v Running with configuration path: /etc/elasticsearch Testing if bootstrap password is valid for [https://10.4.0.4:9200/\_xpack/security/\_authenticate?pretty](https://10.4.0.4:9200/_xpack/security/_authenticate?pretty) SSL connection to [https://10.4.0.4:9200/\_xpack/security/\_authenticate?pretty](https://10.4.0.4:9200/_xpack/security/_authenticate?pretty) failed: java.security.cert.CertificateException: No subject alternative names present Please check the elasticsearch SSL settings under xpack.security.http.ssl. javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) So, the question is do I need to use the certutil tool to generate new certificates that are different for each node? Do I need to specify all the ip addresses and names for each node in the certificate as well as the common domain name? The online documentation doesn't really seem to address this situation. All Ideas gratefully received ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [May 20, 2018, 5:33am UTC](https://discuss.elastic.co/t/multi-node-cluster-setup-passwords-fails/132524/2 "2018-05-20T05:33:06Z")
Hi @KeninHouston, You are on the right track. Looks like you do not have SAN present in the generated certificate applied to all nodes. It would be good to re-generate certificates as described with all IPs and DNS names. We think its always good to go with `full` mode for `verification_mode` as this involves security and other options are less secure. To ease with the certificate generation for different nodes you could use following silent mode with the input file with node details like IPs and DNS names: [https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-silent](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-silent) Just to note documentation does make a recommendation for SAN details but please let us know if you would want us to explicitly mention any more details, suggestions welcome. Hope this helps. Regards, Yogesh Gaikwad ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 17, 2018, 5:33am UTC](https://discuss.elastic.co/t/multi-node-cluster-setup-passwords-fails/132524/3 "2018-06-17T05:33:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.