Trust two different certs on two nodes

[jthoni (John T)]

I think I got it (at least I can use the same pfx from two nodes now without error). The key was in here:

SSLHandshakeException when enabling security

Hi we have a working cluster but when we enable xpack security the transport communication fails. Configuration: bootstrap.memory_lock: true cluster.initial_master_nodes: - elk.mydomain.dk - elk-02.mydomain.dk - elk-03.mydomain.dk cluster.name: elasticsearch-prod discovery.seed_hosts: - elk-02.mydomain.dk - elk-03.mydomain.dk http.port: 9200 network.host: elk.mydomain.dk node.data: false node.ingest: true node.master: true node.max_local_storage_nodes: 1 node.name: ELK path.dat…

First off, my cert did not have the full trust chain, so that was a problem. What resolved it for me was

Got a new sslCert for both Client and Server auth (Extended Key Usage)
I exported this to PEM as keyStore.pem:

openssl pkcs12 -in myCert.pfx -out keyStore.pem -nokeys -nodes

I edited the PEM file to remove out my cert and just keep the CAs.

Instead of specifying truststore, I added:

xpack.security.transport.ssl.certificate_authorities: [ "keyStore.pem" ]

When starting up and running _xpack/ssl/certificates, I see the CAs listed in both the PEM and pfx. Second node is able to join as well.