# When Elasticseach auto configs security, is there any way to inject SANs of my own choosing into the http\_ca.crt? **URL:** \ **Category:** Elasticsearch\ **Created:** [July 16, 2025, 12:22pm UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176 "2025-07-16T12:22:21Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![chad.carson](https://avatars.discourse-cdn.com/v4/letter/c/bc8723/32.png) [@chad.carson](https://discuss.elastic.co/u/chad.carson)\ **Post date:** [July 16, 2025, 12:22pm UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176/1 "2025-07-16T12:22:21Z")
Hello, I am running Elasticsearch in Kubernetes, and everything is up and running well, but if I make any connections from other applications internally across Kubernetes to the exposed service on 9200, it fails the "hostname" check against the http\_ca.crt. The security autoconfig adds the Kubernetes Pod NAME and IP into the SubjectAlternativeName field, but I am connecting to a kubernetes Service I created to expose port 9200 from the Elasticsearch pod. That service IP/name is not in the SAN in http\_ca.crt. If I could get that in there, I think that would take care of the problem. Is there any way to control that? I assume my only option is to NOT use Elastic autoconfig and manually do all the SSL configuration instead, maybe then I can control the SANs. It would be awesome if there was a setting that could predefine SANs before the autoconfig runs and just adds them for me. Am I on the right track? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 18, 2025, 4:22am UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176/2 "2025-07-18T04:22:52Z")
The SANs for the HTTP certificate are determine here: - [elasticsearch/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java at 284121ad9f9175059c06d5cd857d6f3b34a2f56e · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/blob/284121ad9f9175059c06d5cd857d6f3b34a2f56e/x-pack/plugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/AutoConfigureNode.java#L974) We add: - All local IP addresses - `localhost` - The `HOSTNAME` environment variable - The values from `network.publish_host` (which defaults to `network.host`) - The values from `http.publish_host` (which defaults to `http.host` or `network.publish_host`) It sounds like you want to set `http.publish_host` for your node, but there are a range of configuration options there (`network.host`, `http.host`, `network.publish_host`, `http.publish_host`) so you should check the docs and pick the right one for your needs. Start here: - [Networking settings | Reference](https://www.elastic.co/docs/reference/elasticsearch/configuration-reference/networking-settings#http-settings) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 18, 2025, 4:24am UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176/3 "2025-07-18T04:24:52Z")
Also you say `http_ca.crt` but I don't think you really mean that. The CA doesn't have hostnames because it's an issuer and doesn't belong to any particular host. There is a separate HTTP cert on each node (signed by the `http_ca`) and my answer above assumes that you want the correct hostnames in that cert on each node. ---
**Author:** ![chad.carson](https://avatars.discourse-cdn.com/v4/letter/c/bc8723/32.png) [@chad.carson](https://discuss.elastic.co/u/chad.carson)\ **Post date:** [July 21, 2025, 12:21pm UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176/4 "2025-07-21T12:21:35Z")
You are right, it is not the http\_ca.crt, but one of the others that gets generated into that certs directory, I did mis-state that. That http.publish\_host option sounds promising. I did find another workaround, I used a "StatefulSet" in kubernetes to generate the Elasticsearch pod, which causes the pod to always have the same name, even when it is killed and regenerated. So the fact that Elasticsearch ends up using the pod name as HOSTNAME, and hostname is put into the cert, that ends up working because that pod name/hostname remains constant. But I'm going to test the network.publish\_host option as well, that may give me some more flexibility. Thank you for that. ---
**Author:** ![chad.carson](https://avatars.discourse-cdn.com/v4/letter/c/bc8723/32.png) [@chad.carson](https://discuss.elastic.co/u/chad.carson)\ **Post date:** [July 22, 2025, 12:25am UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176/5 "2025-07-22T00:25:51Z")
I was able to create a standalone service in Kubernetes, expose ports 9200 and 9300 from my Elasticsearch pod, and then insert that Service name into the Elasticsearch HTTPs certificate using the http.publish\_host setting. Thanks for the shove in the right direction.