# SSL Connection fail on Elastic 7.8.0 in Docker Container **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [June 25, 2020, 1:57am UTC](https://discuss.elastic.co/t/ssl-connection-fail-on-elastic-7-8-0-in-docker-container/238583 "2020-06-25T01:57:34Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![rainfarmer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rainfarmer/32/71070_2.png) [@rainfarmer](https://discuss.elastic.co/u/rainfarmer)\ **Post date:** [June 25, 2020, 1:57am UTC](https://discuss.elastic.co/t/ssl-connection-fail-on-elastic-7-8-0-in-docker-container/238583/1 "2020-06-25T01:57:34Z")
Hey folks, Following these [instructions](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls.html#tls-http), I've installed a single node Elastic 7.8.0 on docker. Then I create default certs and keys with `bin/elasticsearch-certutil ca ` ` bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12` I move the .p12 to congifs/certs To stop a previous error, I update the .p12 to have permissions 1000:1000 Then I edit config/elasticsearch.yml and add ```auto cluster.name: "docker-cluster" network.host: 0.0.0.0 # also tried the docker ip 123.1.0.1 xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.keystore.path: "/usr/share/elasticsearch/config/certs/elastic-certificates.p12" xpack.security.transport.ssl.truststore.path: "/usr/share/elasticsearch/config/certs/elastic-certificates.p12" xpack.security.transport.ssl.verification_mode: certificate xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: "/usr/share/elasticsearch/config/certs/elastic-certificates.p12" xpack.security.http.ssl.truststore.path: "/usr/share/elasticsearch/config/certs/elastic-certificates.p12" ``` Then restart the container When I go to set user passwords with `bin/elasticsearch-setup-passwords interactive` I get this error ```auto WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to establish trust with server at [123.1.0.1]; the server provided a certificate with subject name [CN=instance] and fingerprint [d5a8c37fd3bbf48327e4753452c2b4ebe12660f2]; the certificate does not have any subject alternative names; the certificate is issued by [CN=Elastic Certificate Tool Autogenerated CA]; the certificate is signed by (subject [CN=Elastic Certificate Tool Autogenerated CA] fingerprint [75af257949c76373a50ff4fa2f90c97aaf7f10f1] {trusted issuer}) which is self-issued; the [CN=Elastic Certificate Tool Autogenerated CA] certificate is trusted in this ssl context ([xpack.security.http.ssl]) [x-pack-security-7.8.0.jar:7.8.0] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-7.8.0.jar:7.8.0] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127) [elasticsearch-cli-7.8.0.jar:7.8.0] at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:91) [elasticsearch-cli-7.8.0.jar:7.8.0] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:127) [elasticsearch-cli-7.8.0.jar:7.8.0] at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-7.8.0.jar:7.8.0] at org.elasticsearch.xpack.security.authc.esnative.tool.SetupPasswordTool.main(SetupPasswordTool.java:116) [x-pack-security-7.8.0.jar:7.8.0] SSL connection to https://123.1.0.1:9200/_security/_authenticate?pretty failed: No subject alternative names present Please check the elasticsearch SSL settings under xpack.security.http.ssl. ERROR: Failed to establish SSL connection to elasticsearch at https://123.1.0.1:9200/_security/_authenticate?pretty. ``` I've troubleshooted this for couple days and checked this forum plenty. - 123.1.0.1 is the ip of the docker container with elastic. I tried updating the config yml so the host ip = 123.1.0.1 but no effect. - If I first set only TLS (not HTTPS), then I am able to set user passwords, but when I activate http.ssl I get error message on elastic search boot up: `{"type": "server", "timestamp": "2020-06-24T22:47:48,739Z", "level": "WARN", "component": "o.e.b.BootstrapChecks", "cluster.name": "docker-cluster", "node.name": "d3b0717b5f42", "message": "Transport ` `SSL` ` must be enabled if security is enabled on a [basic] license. Please set [xpack.security.transport.` `SSL` `.enabled] to [true] or disable security by setting [xpack.security.enabled] to [false]" }` And when I check config for `xpack.security.transport.ssl.enabled: true` it's still there ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 25, 2020, 5:09am UTC](https://discuss.elastic.co/t/ssl-connection-fail-on-elastic-7-8-0-in-docker-container/238583/2 "2020-06-25T05:09:26Z")
> [@rainfarmer](#): > > Following these [instructions](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/configuring-tls.html#tls-http), I've installed a single node Elastic 7.8.0 on docker. Why not the next page in that series, i.e. [Encrypting communications in an Elasticsearch Docker Container | Elasticsearch Guide [7.8] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/configuring-tls-docker.html) which is specifically about docker ? The actual error is printed in the output: > SSL connection to [https://123.1.0.1:9200/\_security/\_authenticate?pretty](https://123.1.0.1:9200/_security/_authenticate?pretty) failed: No subject alternative names present You'd need to recreate your certificates and add the IP ( `123.1.0.1` ) as a SAN , see the `--ip` flag in [elasticsearch-certutil | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html) ---
**Author:** ![rainfarmer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rainfarmer/32/71070_2.png) [@rainfarmer](https://discuss.elastic.co/u/rainfarmer)\ **Post date:** [June 25, 2020, 10:50pm UTC](https://discuss.elastic.co/t/ssl-connection-fail-on-elastic-7-8-0-in-docker-container/238583/3 "2020-06-25T22:50:06Z")
Thanks, that worked. I didnt use those docker instructions, cause I'm not using Docker Compose. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 23, 2020, 11:02pm UTC](https://discuss.elastic.co/t/ssl-connection-fail-on-elastic-7-8-0-in-docker-container/238583/4 "2020-07-23T23:02:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.