# Searchguard.nodes\_dn incorrect configured

**URL:** <https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043>\
**Category:** Search Guard\
**Created:** [January 21, 2021, 4:05pm UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043 "2021-01-21T16:05:29Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![kamolhasan](https://avatars.discourse-cdn.com/v4/letter/k/0ea827/32.png) [@kamolhasan](https://forum.search-guard.com/u/kamolhasan)\
**Post date:** [January 21, 2021, 4:05pm UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/1 "2021-01-21T16:05:30Z")

</div>

**Elasticsearch version:**

- 7.5.2-oss with searchGuard

**Describe the issue:**

The Elasticsearch Run with the following nodes\_dn in elasticsearch.yml:

```nohighlight
searchguard.nodes_dn:
- "CN=es-combined-transport,OU=testing,O=another.com,C=BD"

```

But it fails to run with the following config:

```nohighlight
searchguard.nodes_dn:
- "CN=es-combined-transport,OU=testing,O=mydb.com+O=another.com,C=BD"

```

Error:

```auto
{"type": "server", "timestamp": "2021-01-21T15:38:46,803Z", "level": "ERROR", "component": "c.f.s.t.SearchGuardRequestHandler", "cluster.name": "es-combined", "node.name": "es-combined-2", "message": "ElasticsearchException[Illegal parameter in http or transport request found.\nThis means that one node is trying to connect to another with \na non-node certificate (no OID or searchguard.nodes_dn incorrect configured) or that someone \nis spoofing requests. Check your TLS certificate setup as described here: See http://docs.search-guard.com/latest/troubleshooting-tls]" }

```

My transport certificate:

```auto
$ openssl x509 -text -noout -in transport.crt
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:43:41:4f:fd:ce:da:48:7b:fa:ce:a3:ad:7a:93:ba
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = elasticsearch, O = kubedb
        Validity
            Not Before: Jan 21 15:22:50 2021 GMT
            Not After : Apr 21 15:22:50 2021 GMT
        Subject: C = BD, O = mydb.com + O = another.com, OU = testing, CN = es-combined-transport

```

Questions:

- How to write the nodes\_dn when Organization(O)/OrganizationUnits(OU)/Countries(C) is a list/array?

---

<div class="post-metadata">

**Author:** ![kamolhasan](https://avatars.discourse-cdn.com/v4/letter/k/0ea827/32.png) [@kamolhasan](https://forum.search-guard.com/u/kamolhasan)\
**Post date:** [January 22, 2021, 3:58am UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/2 "2021-01-22T03:58:46Z")

</div>

@srgbnd Can you please take a look?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [January 22, 2021, 9:44am UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/3 "2021-01-22T09:44:12Z")

</div>

A possible solution is to use regular expressions. For example

```auto
searchguard.nodes_dn:
- "CN=es-combined-transport,OU=testing,O=(mydb|another).com,C=BD"

```

---

<div class="post-metadata">

**Author:** ![kamolhasan](https://avatars.discourse-cdn.com/v4/letter/k/0ea827/32.png) [@kamolhasan](https://forum.search-guard.com/u/kamolhasan)\
**Post date:** [January 22, 2021, 10:11am UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/4 "2021-01-22T10:11:36Z")

</div>

@srgbnd Thanks!

But It does work with OrganizationUnits:

```auto
searchguard.nodes_dn:
- "CN=es-combined-transport,OU=testing+OU=dev,O=mydb.com,C=BD"

```

Is it a parser bug?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [January 22, 2021, 6:18pm UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/5 "2021-01-22T18:18:22Z")

</div>

> [@kamolhasan](#):
>
> ```auto
> searchguard.nodes_dn:
> - "CN=es-combined-transport,OU=testing+OU=dev,O=mydb.com,C=BD"
> 
> ```

I don’t see regular expression in your example. Try

```auto
searchguard.nodes_dn:
- "CN=es-combined-transport,OU=(testing|dev),O=mydb.com,C=BD"

```

---

<div class="post-metadata">

**Author:** ![kamolhasan](https://avatars.discourse-cdn.com/v4/letter/k/0ea827/32.png) [@kamolhasan](https://forum.search-guard.com/u/kamolhasan)\
**Post date:** [January 23, 2021, 3:18pm UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/6 "2021-01-23T15:18:41Z")

</div>

I meant, it does work without the regular expression:

Cluster is up and running without any error with the following config:

```nohighlight
searchguard.nodes_dn:
- "CN=es-combined-transport,OU=testing+OU=dev,O=mydb.com,C=BD"

```

But the parser is failing, If I do the same thing with organization( O ).  
I use standard certificate library in my code that read the certificate file and returns the `node_dn` in standard format, that is why it is not easy for me to use regular expression to workaround the error.

Can you please inform me, whether it is a bug that is going to be fixed in future?

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [January 25, 2021, 7:30am UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/7 "2021-01-25T07:30:24Z")

</div>

I would like to see the parser error. Share the Elasticsearch log.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [January 25, 2021, 7:31am UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/8 "2021-01-25T07:31:59Z")

</div>

> [@kamolhasan](#):
>
> I use standard certificate library

Btw, what is the name of the library? Maybe we can configure it to return values in regex somehow?

---

<div class="post-metadata">

**Author:** ![kamolhasan](https://avatars.discourse-cdn.com/v4/letter/k/0ea827/32.png) [@kamolhasan](https://forum.search-guard.com/u/kamolhasan)\
**Post date:** [January 25, 2021, 8:24am UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/9 "2021-01-25T08:24:31Z")

</div>

This is the standard crypto library for Golang:

> **[pkix package - crypto/x509/pkix - Go Packages](https://pkg.go.dev/crypto/x509/pkix)**
>
> Package pkix contains shared, low level structures used for ASN.1 parsing and serialization of X.509 certificates, CRL and OCSP.

> String returns the string form of n, roughly following the RFC 2253 Distinguished Names syntax.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [January 26, 2021, 1:39pm UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/10 "2021-01-26T13:39:12Z")

</div>

Show me the Elasticsearch error.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [February 16, 2021, 1:39pm UTC](https://forum.search-guard.com/t/searchguard-nodes-dn-incorrect-configured/2043/11 "2021-02-16T13:39:24Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.