# Certificate problem

**URL:** <https://forum.search-guard.com/t/certificate-problem/2170>\
**Category:** Search Guard\
**Created:** [June 3, 2021, 11:39am UTC](https://forum.search-guard.com/t/certificate-problem/2170 "2021-06-03T11:39:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![guru1612](https://avatars.discourse-cdn.com/v4/letter/g/b9e5f3/32.png) [@guru1612](https://forum.search-guard.com/u/guru1612)\
**Post date:** [June 3, 2021, 11:39am UTC](https://forum.search-guard.com/t/certificate-problem/2170/1 "2021-06-03T11:39:51Z")

</div>

hi ,  
i have a prolem when connecting searchguard and elasticsearch.  
the problem is  
Search Guard Admin v7  
Will connect to localhost:9300 … done  
Connected as CN=localhost,OU=CE,O=CE,DC=Circular Edge,DC=com  
ERR: CN=localhost,OU=CE,O=CE,DC=Circular Edge,DC=com is not an admin user  
Seems you use a node certificate. This is not permitted, you have to use a client certificate and register it as admin\_dn in elasticsearch.yml

how to solve this?  
I attached .yml files with this  
[elasticsearch.yml](https://forum.search-guard.com/uploads/short-url/oKptJ5dSPyVGG37sOdgYcToQgPV.yml) (3.5 KB)  
topic.

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [June 3, 2021, 12:38pm UTC](https://forum.search-guard.com/t/certificate-problem/2170/2 "2021-06-03T12:38:29Z")

</div>

It seems that when you use sgadmin to make configuration changes you have specified a node certificate, not an admin certificate. For security reasons, you cannot use a node certificate with sgadmin.

In your elasticsearch.yml you have configured one node certificate:

```auto
searchguard.nodes_dn:
- CN=localhost,OU=CE,O=CE,DC=Circular Edge,DC=com

```

and two admin certificates:

```auto
searchguard.authcz.admin_dn:
- CN=spock.com,OU=CE,O=CE,DC=Circular Edge,DC=com
- CN=kirk.com,OU=CE,O=CE,DC=Circular Edge,DC=com

```

Please use either the `spock` or `kirk` certificate with sgadmin.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [June 24, 2021, 12:38pm UTC](https://forum.search-guard.com/t/certificate-problem/2170/3 "2021-06-24T12:38:38Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.