# SAN required in cert?

**URL:** <https://discuss.elastic.co/t/san-required-in-cert/390541>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 19, 2026, 11:03pm UTC](https://discuss.elastic.co/t/san-required-in-cert/390541 "2026-09-19T23:03:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rik/32/147516_2.png) [@rik](https://discuss.elastic.co/u/rik)\
**Post date:** [September 19, 2026, 11:03pm UTC](https://discuss.elastic.co/t/san-required-in-cert/390541/1 "2026-09-19T23:03:53Z")

</div>

I am trying to use an ES service from a remote machine, using the cert  
copied from the container: `podman cp app:/usr/share/elasticsearch/config/certs`  
But simply doing a `client.info()` I am getting a `elastic_transport.ConnectionTimeout: Connection timed out` exception

`File ".../miniconda3/envs/ocd4oak/lib/python3.13/site-packages/elastic_transport/_node/_http_urllib3.py", line 167, in perform_request`

Doing a simpler, direct curl:

`curl -v --cacert .../certs/ca/ca.crt -H "Authorization: ApiKey ...tLU0Jzdw==" --max-time 15 https://192.168.0.240:9200/`

complains about the cert (produced by ES) not having a matching subjectAltName:

```auto
	* subjectAltName does not match ipv4 address 192.168.0.240
	* SSL: no alternative certificate subject name matches target ipv4 address '192.168.0.240'
	* Closing connection

	curl: (60) SSL: no alternative certificate subject name matches target ipv4 address '192.168.0.240'
	More details here: 

	curl failed to verify the legitimacy of the server and therefore could not
	establish a secure connection to it. To learn more about this situation and
	how to fix it, please visit the web page mentioned above.

	Your SSL/TLS certificate does not include the target IP address
	(192.168.0.240) in its Subject Alternative Name (SAN) list.When you
	connect via an IP address instead of a domain name, modern SSL
	verification requires the certificate to explicitly list that IP
	address as an IPAddress entry in its SAN.

```

I see mention of Subject Alternative Name here: [Set up HTTPS | Elastic Docs](https://www.elastic.co/docs/deploy-manage/security/set-up-basic-security-plus-https#encrypt-http-communication)  
But it mentions a different format cert: `elastic-stack-ca.p12 ` ; my ES node  
has this: `./config/certs/ca`

Do I need to create my own cert according to these instructions, or  
am I misssing something else?

---

<div class="post-metadata">

**Author:** ![rik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rik/32/147516_2.png) [@rik](https://discuss.elastic.co/u/rik)\
**Post date:** [September 19, 2026, 11:26pm UTC](https://discuss.elastic.co/t/san-required-in-cert/390541/2 "2026-09-19T23:26:37Z")

</div>

update: claude thinks any cert issues are unrelated to the timeout.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 20, 2026, 7:06pm UTC](https://discuss.elastic.co/t/san-required-in-cert/390541/3 "2026-09-20T19:06:49Z")

</div>

Hi @rik

Yes you need to add the IP address / hostname as a SAN / IP to the certs that you use to connect with a client if you want to do cerficate validation, otherwise there SAN/IP match and the SSL will fail

The curl command you ran is actually telling you that.

The [docs](https://www.elastic.co/docs/deploy-manage/security/set-up-basic-security-plus-https#encrypt-http-communication) you reference explain how

> 1. When asked if you want to generate one certificate per node, enter `y`.
> 
> 2. When prompted, enter the name of the first node in your cluster.
> 
> 3. Enter all hostnames used to connect to your first node. These hostnames will be added as DNS names in the Subject Alternative Name (SAN) field in your certificate.
> 
> 4. Enter the IP addresses that clients can use to connect to your node.

There is an easier what with an instances file see [here](https://www.elastic.co/docs/reference/elasticsearch/command-line-tools/certutil#certutil-silent)