SAN required in cert?

Elastic Stack Elasticsearch
1

I am trying to use an ES service from a remote machine, using the cert
copied from the container: podman cp app:/usr/share/elasticsearch/config/certs
But simply doing a client.info() I am getting a elastic_transport.ConnectionTimeout: Connection timed out exception

File ".../miniconda3/envs/ocd4oak/lib/python3.13/site-packages/elastic_transport/_node/_http_urllib3.py", line 167, in perform_request

Doing a simpler, direct curl:

curl -v --cacert .../certs/ca/ca.crt -H "Authorization: ApiKey ...tLU0Jzdw==" --max-time 15 https://192.168.0.240:9200/

complains about the cert (produced by ES) not having a matching subjectAltName:

	*  subjectAltName does not match ipv4 address 192.168.0.240
	* SSL: no alternative certificate subject name matches target ipv4 address '192.168.0.240'
	* Closing connection

	curl: (60) SSL: no alternative certificate subject name matches target ipv4 address '192.168.0.240'
	More details here: 


	curl failed to verify the legitimacy of the server and therefore could not
	establish a secure connection to it. To learn more about this situation and
	how to fix it, please visit the web page mentioned above.

	Your SSL/TLS certificate does not include the target IP address
	(192.168.0.240) in its Subject Alternative Name (SAN) list.When you
	connect via an IP address instead of a domain name, modern SSL
	verification requires the certificate to explicitly list that IP
	address as an IPAddress entry in its SAN.

I see mention of Subject Alternative Name here: Set up HTTPS | Elastic Docs
But it mentions a different format cert: elastic-stack-ca.p12 ; my ES node
has this: ./config/certs/ca

Do I need to create my own cert according to these instructions, or
am I misssing something else?

2

update: claude thinks any cert issues are unrelated to the timeout.

3

Hi @rik

Yes you need to add the IP address / hostname as a SAN / IP to the certs that you use to connect with a client if you want to do cerficate validation, otherwise there SAN/IP match and the SSL will fail

The curl command you ran is actually telling you that.

The docs you reference explain how

  1. When asked if you want to generate one certificate per node, enter y.

    Each certificate will have its own private key, and will be issued for a specific hostname or IP address.

  2. When prompted, enter the name of the first node in your cluster.

  3. Enter all hostnames used to connect to your first node. These hostnames will be added as DNS names in the Subject Alternative Name (SAN) field in your certificate.

    List every hostname and variant used to connect to your cluster over HTTPS.

  4. Enter the IP addresses that clients can use to connect to your node.

There is an easier what with an instances file see here