# I really don't know where the problem is. **URL:** \ **Category:** Search Guard\ **Created:** [July 23, 2018, 2:09am UTC](https://forum.search-guard.com/t/i-really-dont-know-where-the-problem-is/1033 "2018-07-23T02:09:35Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![11110](https://avatars.discourse-cdn.com/v4/letter/1/e19adc/32.png) [@11110](https://forum.search-guard.com/u/11110)\ **Post date:** [July 23, 2018, 2:09am UTC](https://forum.search-guard.com/t/i-really-dont-know-where-the-problem-is/1033/1 "2018-07-23T02:09:35Z")
Search Guard and Elasticsearch version:6.3.0 - JVM version and operating system version:1.8\_144 Search Guard Admin v6 Will connect to [172.16.194.239:9300](http://172.16.194.239:9300) … done Unable to check whether cluster is sane: No user found for cluster:monitor/nodes/info Connected as CN=[node-ops-elasticsearch-Alarm-node04.example.com](http://node-ops-elasticsearch-Alarm-node04.example.com),OU=SSL,O=Test,L=Test,C=DE ERR: CN=[node-ops-elasticsearch-Alarm-node04.example.com](http://node-ops-elasticsearch-Alarm-node04.example.com),OU=SSL,O=Test,L=Test,C=DE is not an admin user Seems you use a node certificate. This is not permitted, you have to use a client certificate and register it as admin\_dn in elasticsearch.yml My profile is [cluster.name](http://cluster.name): ops-elasticsearch-Alarm [node.name](http://node.name): ops-elasticsearch-Alarm-node04 node.master: false node.data: true path.data: /data/servers/elasticsearch-data path.logs: /data/servers/elasticsearch-log bootstrap.memory\_lock: true bootstrap.system\_call\_filter: false indices.fielddata.cache.size: 50mb network.host: 172.16.194.239 http.port: 9200 discovery.zen.minimum\_master\_nodes: 2 discovery.zen.fd.ping\_timeout: 60s discovery.zen.fd.ping\_interval: 30s discovery.zen.fd.ping\_retries: 6 discovery.zen.ping.unicast.hosts: [“ops-elasticsearch-Alarm-master01”,“ops-elasticsearch-Alarm-master02”,“ops-elasticsearch-Alarm-master03”] cluster.routing.allocation.node\_initial\_primaries\_recoveries: 50 cluster.routing.allocation.node\_concurrent\_recoveries: 50 cluster.routing.allocation.cluster\_concurrent\_rebalance: 50 xpack.monitoring.collection.enabled: true xpack.monitoring.enabled: true xpack.graph.enabled: true action.auto\_create\_index: “\*” searchguard.ssl.transport.keystore\_type: JKS searchguard.ssl.transport.keystore\_filepath: node-ops-elasticsearch-Alarm-node04-keystore.jks searchguard.ssl.transport.keystore\_password: KtdzbtbwBKUo70Ze1u3X searchguard.ssl.transport.truststore\_type: JKS searchguard.ssl.transport.truststore\_filepath: truststore.jks searchguard.ssl.transport.truststore\_password: KtdzbtbwBKUo70Ze1u3X searchguard.ssl.transport.enforce\_hostname\_verification: false searchguard.ssl.transport.resolve\_hostname: false searchguard.ssl.http.enabled: false searchguard.ssl.http.keystore\_filepath: node-ops-elasticsearch-Alarm-node04-keystore.jks searchguard.ssl.http.keystore\_password: KtdzbtbwBKUo70Ze1u3X searchguard.ssl.http.truststore\_filepath: truststore.jks searchguard.ssl.http.truststore\_password: KtdzbtbwBKUo70Ze1u3X http.compression: true http.compression\_level: 5 xpack.security.enabled: false searchguard.authcz.admin\_dn: - “CN=node-ops-elasticsearch-Alarm-node04,OU=client,O=client,L=test,C=DE” Request help The error message and the configuration in the configuration file do not match, I have no clue. ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [July 23, 2018, 7:58pm UTC](https://forum.search-guard.com/t/i-really-dont-know-where-the-problem-is/1033/2 "2018-07-23T19:58:34Z")
“Seems you use a node certificate. This is not permitted, you have to use a client certificate and register it as admin\_dn in elasticsearch.yml” You try to use a certificate that is configured/used as a node certificate when using sgadmin. This is not permitted, you need a separate client certificate. Most likely the certificate in this JKS file here that is used on the node: searchguard.ssl.transport.keystore\_filepath: node-ops-elasticsearch-Alarm-node04-keystore.jks `` Contains this certificate here that you use when using sgadmin: CN=[node-ops-elasticsearch-Alarm-node04.example.com](http://node-ops-elasticsearch-alarm-node04.example.com/),OU=SSL,O=Test,L=Test,C=DE `` You need a separate certificate that is not used as node cert: For the types of certificates please see here: [https://docs.search-guard.com/latest/tls-in-production#types-of-certificates](https://docs.search-guard.com/latest/tls-in-production#types-of-certificates) > **···** > > On Monday, July 23, 2018 at 4:07:59 AM UTC+2, 付浩 wrote: > > > > > > Search Guard and Elasticsearch version:6.3.0 > > > - JVM version and operating system version:1.8\_144 > > > > > > Search Guard Admin v6 > > > Will connect to [172.16.194.239:9300](http://172.16.194.239:9300) … done > > > Unable to check whether cluster is sane: No user found for cluster:monitor/nodes/info > > > Connected as CN=[node-ops-elasticsearch-Alarm-node04.example.com](http://node-ops-elasticsearch-Alarm-node04.example.com),OU=SSL,O=Test,L=Test,C=DE > > > ERR: CN=[node-ops-elasticsearch-Alarm-node04.example.com](http://node-ops-elasticsearch-Alarm-node04.example.com),OU=SSL,O=Test,L=Test,C=DE is not an admin user > > > Seems you use a node certificate. This is not permitted, you have to use a client certificate and register it as admin\_dn in elasticsearch.yml > > > > > > > > > My profile is > > > > > > [cluster.name](http://cluster.name): ops-elasticsearch-Alarm > > > [node.name](http://node.name): ops-elasticsearch-Alarm-node04 > > > node.master: false > > > node.data: true > > > path.data: /data/servers/elasticsearch-data > > > path.logs: /data/servers/elasticsearch-log > > > bootstrap.memory\_lock: true > > > bootstrap.system\_call\_filter: false > > > indices.fielddata.cache.size: 50mb > > > network.host: 172.16.194.239 > > > http.port: 9200 > > > discovery.zen.minimum\_master\_nodes: 2 > > > discovery.zen.fd.ping\_timeout: 60s > > > discovery.zen.fd.ping\_interval: 30s > > > discovery.zen.fd.ping\_retries: 6 > > > discovery.zen.ping.unicast.hosts: [“ops-elasticsearch-Alarm-master01”,“ops-elasticsearch-Alarm-master02”,“ops-elasticsearch-Alarm-master03”] > > > cluster.routing.allocation.node\_initial\_primaries\_recoveries: 50 > > > cluster.routing.allocation.node\_concurrent\_recoveries: 50 > > > cluster.routing.allocation.cluster\_concurrent\_rebalance: 50 > > > xpack.monitoring.collection.enabled: true > > > xpack.monitoring.enabled: true > > > xpack.graph.enabled: true > > > action.auto\_create\_index: “\*” > > > searchguard.ssl.transport.keystore\_type: JKS > > > searchguard.ssl.transport.keystore\_filepath: node-ops-elasticsearch-Alarm-node04-keystore.jks > > > searchguard.ssl.transport.keystore\_password: KtdzbtbwBKUo70Ze1u3X > > > searchguard.ssl.transport.truststore\_type: JKS > > > searchguard.ssl.transport.truststore\_filepath: truststore.jks > > > searchguard.ssl.transport.truststore\_password: KtdzbtbwBKUo70Ze1u3X > > > searchguard.ssl.transport.enforce\_hostname\_verification: false > > > searchguard.ssl.transport.resolve\_hostname: false > > > searchguard.ssl.http.enabled: false > > > searchguard.ssl.http.keystore\_filepath: node-ops-elasticsearch-Alarm-node04-keystore.jks > > > searchguard.ssl.http.keystore\_password: KtdzbtbwBKUo70Ze1u3X > > > searchguard.ssl.http.truststore\_filepath: truststore.jks > > > searchguard.ssl.http.truststore\_password: KtdzbtbwBKUo70Ze1u3X > > > http.compression: true > > > http.compression\_level: 5 > > > xpack.security.enabled: false > > > searchguard.authcz.admin\_dn: > > > - “CN=node-ops-elasticsearch-Alarm-node04,OU=client,O=client,L=test,C=DE” > > > > > > Request help > > > > > > The error message and the configuration in the configuration file do not match, I have no clue.