When asking questions, please provide the following information:
-
Search Guard and Elasticsearch version
-
Installed and used enterprise modules, if any
-
JVM version and operating system version
-
Search Guard configuration files
-
Elasticsearch log messages on debug level
-
Other installed Elasticsearch or Kibana plugins, if any
ES version - 5.6.3
Kibana version - 5.6.3
Searchguard version - 5.6.3
Java Version - 1.8.0_152
I have a cert (elastic.example.com) that has alias of all my NODE hostname (es1.example.com, es2.example.com, es3.example.com).
here is the elasticsearch.yaml file I set the OID found in elastic.example.com cert on all 3 nodes elasticsearch yaml file.
bootstrap.memory_lock: false
cluster.name: ishlab-logging
discovery.zen.minimum_master_nodes: 2
discovery.zen.ping.unicast.hosts:
network.host: x.x.x.x
node.max_local_storage_nodes: 3
node.name: es1-es-01
path.data: “/var/lib/elasticsearch/es-01”
path.logs: “/var/log/elasticsearch/es-01”
searchguard.cert.oid: 1.3.6.1.4.1.44947.1.1.1
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: “/etc/elasticsearch/es-01/searchguard/elastic.example.com/fullchain.pem”
searchguard.ssl.http.pemkey_filepath: “/etc/elasticsearch/es-01/searchguard/elastic.example.com/private.pkcs8”
searchguard.ssl.http.pemtrustedcas_filepath: “/etc/elasticsearch/es-01/searchguard/elastic.example.com/fullchain.pem”
searchguard.ssl.transport.enforce_hostname_verification: true
searchguard.ssl.transport.pemcert_filepath: “/etc/elasticsearch/es-01/searchguard/elastic.example.com/fullchain.pem”
searchguard.ssl.transport.pemkey_filepath: “/etc/elasticsearch/es-01/searchguard/elastic.example.com/private.pkcs8”
searchguard.ssl.transport.pemtrustedcas_filepath: “/etc/elasticsearch/es-01/searchguard/elastic.example.com/fullchain.pem”
thread_pool.bulk.queue_size: 2000
xpack.graph.enabled: false
xpack.ml.enabled: false
xpack.monitoring.enabled: true
xpack.monitoring.exporters.id1.auth.password: kibanaserver
xpack.monitoring.exporters.id1.auth.username: kibanaserver
xpack.monitoring.exporters.id1.host: https://ish.example.com:9200
xpack.monitoring.exporters.id1.type: http
xpack.monitoring.history.duration: 1d
xpack.security.enabled: false
xpack.watcher.enabled: false
I’m getting the following error on each node… Nodes can’t ping each other. (no OID or searchguard.nodes_dn incorrect configured).
[2018-02-09T14:24:15,219][WARN ][o.e.d.z.UnicastZenPing ] [es1-es-01] [8] failed send ping to {#zen_unicast_es1.example.com_0#}{tEuZDtj8RvC_yLILyR-ysA}{es1.example.com}{x.x.x.x:9300}
java.lang.IllegalStateException: handshake failed with {#zen_unicast_es1.example.com_0#}{tEuZDtj8RvC_yLILyR-ysA}{es1.example.com}{x.x.x.x:9300}
at org.elasticsearch.transport.TransportService.handshake(TransportService.java:403) ~[elasticsearch-5.6.3.jar:5.6.3]
at org.elasticsearch.transport.TransportService.handshake(TransportService.java:370) ~[elasticsearch-5.6.3.jar:5.6.3]
at org.elasticsearch.discovery.zen.UnicastZenPing$PingingRound.getOrConnect(UnicastZenPing.java:400) ~[elasticsearch-5.6.3.jar:5.6.3]
at org.elasticsearch.discovery.zen.UnicastZenPing$3.doRun(UnicastZenPing.java:507) [elasticsearch-5.6.3.jar:5.6.3]
at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:638) [elasticsearch-5.6.3.jar:5.6.3]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-5.6.3.jar:5.6.3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_152]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_152]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_152]
Caused by: org.elasticsearch.transport.RemoteTransportException: [es1-es-01][x.x.x.x:9300][internal:transport/handshake]
Caused by: org.elasticsearch.ElasticsearchException: bad header found. This means typically that one node try to connect to another with a non-node certificate (no OID or searchguard.nodes_dn incorrect configured) or that someoneis spoofing requests. See https://github.com/floragunncom/search-guard-docs/blob/master/tls_node_certificates.md
Any help on how to configure this?