# The target principal name is incorrect **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 19, 2021, 11:08pm UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113 "2021-07-19T23:08:40Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![sunilr](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sunilr](https://discuss.elastic.co/u/sunilr)\ **Post date:** [July 19, 2021, 11:08pm UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113/1 "2021-07-19T23:08:40Z")
I am using these below settings and newly created certificate for setting up Transport and HTTP security. 1. **My setting in elasticsearch.yml is as below:** xpack.security.enabled : True xpack.security.transport.ssl.enabled : True xpack.security.transport.ssl.verification\_mode : certificate xpack.security.transport.ssl.key : /app/cd1/qa/elasticsearch-latest/config/certs/ucmelasticn.key xpack.security.transport.ssl.certificate : /app/cd1/qa/elasticsearch-latest/config/certs/ucmelasticn.cer xpack.security.transport.ssl.certificate\_authorities : ["/app/cd1/qa/elasticsearch-latest/config/certs/CorporationIssuing.crt"] xpack.security.transport.ssl.supported\_protocols : ["TLSv1.2"] xpack.security.http.ssl.enabled : True xpack.security.http.ssl.verification\_mode : certificate xpack.security.http.ssl.key : /app/cd1/qa/elasticsearch-latest/config/certs/ucmelasticn.key xpack.security.http.ssl.certificate : /app/cd1/qa/elasticsearch-latest/config/certs/ucmelasticn.cer xpack.security.http.ssl.certificate\_authorities : ["/app/cd1/qa/elasticsearch-latest/config/certs/CorporationIssuing.crt"] xpack.security.http.ssl.supported\_protocols : ["TLSv1.2"] 1. My elasticsearchcluster is of 8 nodes and i am just trying to bring up first master node only, Certificate is same for all 8 nodes as it contains DNS entries of all 8 nodes. 2. **while i try to hit the url, I get following error:** C:\Program Files\Java\jdk1.8.0\_291\bin\>curl -v [https://rt31a10088qv00:9200](https://rt31a10088qv00:9200) - Rebuilt URL to: [https://rt31a10088qv00:9200/](https://rt31a10088qv00:9200/) - Trying 10.200.77.27... - TCP\_NODELAY set - Connected to rt31a10088qv00 (10.200.77.27) port 9200 (#0) - schannel: SSL/TLS connection with rt31a10088qv00 port 9200 (step 1/3) - schannel: checking server certificate revocation - schannel: sending initial handshake data: sending 183 bytes... - schannel: sent initial handshake data: sent 183 bytes - schannel: SSL/TLS connection with rt31a10088qv00 port 9200 (step 2/3) - schannel: failed to receive handshake, need more data - schannel: SSL/TLS connection with rt31a10088qv00 port 9200 (step 2/3) - schannel: encrypted data got 2400 - schannel: encrypted data buffer: offset 2400 length 4096 - schannel: SNI or certificate check failed: SEC\_E\_WRONG\_PRINCIPAL (0x80090322) - The target principal name is incorrect. - Closing connection 0 - schannel: shutting down SSL/TLS connection with rt31a10088qv00 port 9200 - schannel: clear security context handle curl: (35) schannel: SNI or certificate check failed: SEC\_E\_WRONG\_PRINCIPAL (0x80090322) - The target principal name is incorrect. Please advise. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 22, 2021, 4:30am UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113/2 "2021-07-22T04:30:16Z")
> [@sunilr](#): > > curl: (35) schannel: SNI or certificate check failed: SEC\_E\_WRONG\_PRINCIPAL (0x80090322) - The target principal name is incorrect. This is [Schannel](https://docs.microsoft.com/en-us/windows-server/security/tls/tls-ssl-schannel-ssp-overview) being particular cryptic in its error messages. The most probable explanation is that the certificate you are using (`ucmelasticn.cer`) is not valid for the hostname your are providing to curl ( `rt31a10088qv00`). ---
**Author:** ![sunilr](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@sunilr](https://discuss.elastic.co/u/sunilr)\ **Post date:** [July 22, 2021, 9:48pm UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113/3 "2021-07-22T21:48:38Z")
1. I added "-k" option in curl and it worked as below. 2. I also tried using https connection from java by allowing untrusted https connection and was able to push data in elastic. I ```auto curl reply is below: curl -k https://localhost:9200 { "name" : "rt31a10088qv00.bnymellon.net-master", "cluster_name" : "cd1-qtxa-elastic-cluster-qa-primary", "cluster_uuid" : "TdvBInVNQtGmMDtTfpt2bw", "version" : { "number" : "7.6.1", "build_flavor" : "default", "build_type" : "tar", "build_hash" : "aa751e09be0a5072e8570670309b1f12348f023b", "build_date" : "2020-02-29T00:15:25.529771Z", "build_snapshot" : false, "lucene_version" : "8.4.0", "minimum_wire_compatibility_version" : "6.8.0", "minimum_index_compatibility_version" : "6.0.0-beta1" }, "tagline" : "You Know, for Search" } ``` My question: Does it mean certificates are good or have some issues that will create problem later? Any thoughts/suggestions will be highly appreciated. Thank you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 19, 2021, 9:48pm UTC](https://discuss.elastic.co/t/the-target-principal-name-is-incorrect/279113/4 "2021-08-19T21:48:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.