# TSL: Unable to connect to remote cluster, certificate missing "common-names" **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 26, 2022, 2:24am UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855 "2022-11-26T02:24:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hkhalil](https://avatars.discourse-cdn.com/v4/letter/h/e9bcb4/32.png) [@hkhalil](https://discuss.elastic.co/u/hkhalil)\ **Post date:** [November 26, 2022, 2:24am UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/1 "2022-11-26T02:24:26Z")
Hi, We would like to use markdown to display images on our Kibana dashboards which are hosted in the cloud (i.e.: "Elastic Cloud"). Those images are confidential. As such, we cannot host them on a server accessible from outside our network. This prevents us from accessing them from our Kibana cloud instance. As an alternative, I thought of hosting Kibana internally, yet have it connect to our Elastic cloud instance. The server hosting Kibana would be on our internal network. My hopes would be that we could specify a path in markdown pointing a location on our internal NAS. This led me to learn more about "Remote Clusters" and Cross Cluster Search. I configured an Elastic stack ( **v8.5.2** , same as our cloud instance) on a machine on our network and followed the various guides to setup TSL on the transport port. I have created a CA using: `elasticsearch-certutil ca --pem --ca-dn CN=hussein_local_CA` I created a "Trusted Environment" on my cloud instance using that CA certificate. ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbe467372a177584fbb0e7bad039bb0c9fefc81d.png) I then created a certificate using that CA, the output file being "elastic-certificates.p12": `elasticsearch-certutil cert --ca-cert ca.crt --ca-key ca.key` I downloaded the CA certificate from my cloud instance and imported it into the truststore "elastic-certificates.p12" using: `keytool.exe -importcert -trustcacerts -noprompt -keystore elastic-certificates.p12 -storepass X -alias X -file CloudInstanceCAFile.crt` Here is what my elastic.yml on my local instance looks like: ![elastic](https://us1.discourse-cdn.com/elastic/original/3X/0/1/01056679168878f07eb488565d51557597441b12.png) Finally, on my local Elastic instance, I've added my cloud instance as a remote cluster. Unfortunately, when attempting to establish a connection, the cloud instance returns the following error: ![ErrorCloud](https://us1.discourse-cdn.com/elastic/original/3X/4/8/4889876b1e91cce513dea56bb98e82dbe96d99fc.png) The CA is trusted, yet for some reason the certificate is not verified against the known trusted names. I synced elastic's code from Git and looked at what could possibly represent those "common-names" that seem to be missing. I found the following in RestrictedTrustManager.java: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/6/16628a8faea660209c8f0c0dd00e2e227df95186.png) Using _elasticsearch-certutil cert_, I'm not sure exactly how to specify the attributes its looking for. Any help would be greatly appreciated. Thanks ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 27, 2022, 11:35pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/2 "2022-11-27T23:35:25Z")
To generate the required common-name, you need use [eleaticsearch-certutil with YAML input](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-silent) The common name can be specified with the `cn` attribute, e.g.: ```auto instances: - name: "node1" cn: "my-common-name" ip: - "192.0.2.1" dns: - "node1.mydomain.com" ``` ---
**Author:** ![hkhalil](https://avatars.discourse-cdn.com/v4/letter/h/e9bcb4/32.png) [@hkhalil](https://discuss.elastic.co/u/hkhalil)\ **Post date:** [November 28, 2022, 7:10am UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/3 "2022-11-28T07:10:21Z")
This worked great, thank you ! I could have missed it, but I believe this step is not part of the official documentations for TSL / remote clusters configuration. It could be worth adding. Thanks again ! ---
**Author:** ![Justin\_Cranford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_cranford/32/85302_2.png) [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)\ **Post date:** [November 28, 2022, 1:18pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/4 "2022-11-28T13:18:33Z")
Elastic Cloud documents its SAN otherName format requirement here. > **[Trust management | Elasticsearch Service Documentation | Elastic](https://www.elastic.co/guide/en/cloud/current/ec-trust-management.html#ec-trust-self-managed)** SAN otherName is a key/value pair. The key is CN. That is the CN value in the YAML file mentioned by @Yang_Wang, so it does seem to be documented. ---
**Author:** ![hkhalil](https://avatars.discourse-cdn.com/v4/letter/h/e9bcb4/32.png) [@hkhalil](https://discuss.elastic.co/u/hkhalil)\ **Post date:** [November 28, 2022, 4:17pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/5 "2022-11-28T16:17:03Z")
Thanks @Justin_Cranford. The [elastic-certutil](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-silent) documentation tells you about YML support, but doesn't provide an example for setting the CN value. Looking at the help prompt in command line for certutil, `-E` should be used to "configure a setting" using a KVP format, but I couldn't find an example. I've tried using that flag with no success. The [Remote Clusters](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters.html) documentation takes you to the [Configure remote clusters with security](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-security.html) page, which in turn takes you to the [Set up basic security for the Elastic stack](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup.html) page. That page shows a certificate generation example using `elasticsearch-certutil cert` but doesn't mention having to use YML to configure SAN otherName. I'm mostly looking at this from the POV of someone not familiar with SSL/TSL, there's a lot to digest and not all of it is immediately apparent. ---
**Author:** ![Justin\_Cranford](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/justin_cranford/32/85302_2.png) [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)\ **Post date:** [November 28, 2022, 5:51pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/6 "2022-11-28T17:51:28Z")
Thank you! That is great feedback. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 26, 2022, 5:52pm UTC](https://discuss.elastic.co/t/tsl-unable-to-connect-to-remote-cluster-certificate-missing-common-names/319855/7 "2022-12-26T17:52:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.