Searchguard nodes not joining cluster?

Hello,
I’m trying to allow my other nodes join the Elasticsearch cluster protected with searchguard but when node-2 tries to join the cluster i get this errors(instead of my local domain there is [mylocaldomain]):
[2016-05-07 16:38:59,695][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event
[2016-05-07 16:39:01,174][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] connected to node [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}]
[2016-05-07 16:39:01,193][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] exception caught on transport layer [[id: 0x32507a86, /192.168.0.31:50464 => host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300]], closing connection
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)
at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)
… 18 more
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching host-192-168-0-21.[mylocaldomain].local found.
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:204)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:95)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
… 26 more
[2016-05-07 16:39:01,196][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event

``

And on the node 1 logs i see:

[2016-05-07 16:39:01,137][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-1] exception caught on transport layer [[id: 0x2467bc1a, /192.168.0.31:50464 => /192.168.0.21:9300]], closing connection
javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800)
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)

``

I have generated the certificates with example-pki-scripts/example.sh on node-1 then i copied the node-2-keystore.jks and trustore.jks on node-2 sgconfig , executed the sgadmin.sh to commit(no errors) the configuration and then restarted ES.
I am missing something to make the nodes joining?i have tried to edit /etc/hosts if something changes for host-192-168-0-21.[mylocaldomain].local found but nothing.
The searchguard configuration on ES(node-2) is this:
searchguard.ssl.transport.enabled: true
searchguard.ssl.transport.keystore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/node-2-keystore.jks

searchguard.ssl.transport.truststore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/truststore.jks

logger.com.floragunn.searchguard.ssl: DEBUG

discovery.zen.ping.unicast.hosts: [“192.168.0.21”]
security.manager.enabled: false

searchguard.authcz.admin_dn:

``

``
Now both ES nodes are working but out of the cluster.

try

searchguard.ssl.transport.enforce_hostname_verification: true

or

include host-192-168-0-21.[mylocaldomain].local in the san list in your certificates
(https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh line 35 and 49)

···

Am 07.05.2016 um 19:08 schrieb Sami Yessou <yessou.sami@gmail.com>:

Hello,
I'm trying to allow my other nodes join the Elasticsearch cluster protected with searchguard but when node-2 tries to join the cluster i get this errors(instead of my local domain there is [mylocaldomain]):
[2016-05-07 16:38:59,695][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event
[2016-05-07 16:39:01,174][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] connected to node [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}]
[2016-05-07 16:39:01,193][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] exception caught on transport layer [[id: 0x32507a86, /192.168.0.31:50464 => host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300]], closing connection
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
   at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
   at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
   at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
   at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
   at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
   at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
   at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
   at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
   at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
   at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
   at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
   at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
   at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
   at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
   at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
   at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
   at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
   at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
   at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
   at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
   at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
   at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
   at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
   at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)
   at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)
   at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
   at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
   at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
   at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
   at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)
   at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)
   at java.security.AccessController.doPrivileged(Native Method)
   at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)
   at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)
   at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)
   ... 18 more
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching host-192-168-0-21.[mylocaldomain].local found.
   at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:204)
   at sun.security.util.HostnameChecker.match(HostnameChecker.java:95)
   at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
   at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
   at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)
   at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
   at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
   ... 26 more
[2016-05-07 16:39:01,196][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event

And on the node 1 logs i see:

[2016-05-07 16:39:01,137][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-1] exception caught on transport layer [[id: 0x2467bc1a, /192.168.0.31:50464 => /192.168.0.21:9300]], closing connection
javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
   at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
   at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
   at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
   at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800)
   at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083)
   at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907)
   at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
   at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
   at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
   at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
   at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
   at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
   at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
   at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
   at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
   at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
   at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
   at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
   at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
   at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
   at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
   at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
   at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
   at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
   at java.lang.Thread.run(Thread.java:745)

I have generated the certificates with example-pki-scripts/example.sh on node-1 then i copied the node-2-keystore.jks and trustore.jks on node-2 sgconfig , executed the sgadmin.sh to commit(no errors) the configuration and then restarted ES.
I am missing something to make the nodes joining?i have tried to edit /etc/hosts if something changes for host-192-168-0-21.[mylocaldomain].local found but nothing.
The searchguard configuration on ES(node-2) is this:
searchguard.ssl.transport.enabled: true
searchguard.ssl.transport.keystore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/node-2-keystore.jks

searchguard.ssl.transport.truststore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/truststore.jks

logger.com.floragunn.searchguard.ssl: DEBUG

discovery.zen.ping.unicast.hosts: ["192.168.0.21"]
security.manager.enabled: false

searchguard.authcz.admin_dn:
- "CN=node-2.example.com, OU=SSL, O=Test, L=Test, C=DE"

Now both ES nodes are working but out of the cluster.

--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/fa060dec-c82f-409e-91d1-f93ed44a2b0e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

sorry, meant

searchguard.ssl.transport.enforce_hostname_verification: false

···

Am 08.05.2016 um 00:08 schrieb SG <info@search-guard.com>:

try

searchguard.ssl.transport.enforce_hostname_verification: true

or

include host-192-168-0-21.[mylocaldomain].local in the san list in your certificates
(https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh line 35 and 49)

Am 07.05.2016 um 19:08 schrieb Sami Yessou <yessou.sami@gmail.com>:

Hello,
I'm trying to allow my other nodes join the Elasticsearch cluster protected with searchguard but when node-2 tries to join the cluster i get this errors(instead of my local domain there is [mylocaldomain]):
[2016-05-07 16:38:59,695][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event
[2016-05-07 16:39:01,174][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] connected to node [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}]
[2016-05-07 16:39:01,193][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] exception caught on transport layer [[id: 0x32507a86, /192.168.0.31:50464 => host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300]], closing connection
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)
at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)
... 18 more
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching host-192-168-0-21.[mylocaldomain].local found.
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:204)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:95)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
... 26 more
[2016-05-07 16:39:01,196][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event

And on the node 1 logs i see:

[2016-05-07 16:39:01,137][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-1] exception caught on transport layer [[id: 0x2467bc1a, /192.168.0.31:50464 => /192.168.0.21:9300]], closing connection
javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800)
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)

I have generated the certificates with example-pki-scripts/example.sh on node-1 then i copied the node-2-keystore.jks and trustore.jks on node-2 sgconfig , executed the sgadmin.sh to commit(no errors) the configuration and then restarted ES.
I am missing something to make the nodes joining?i have tried to edit /etc/hosts if something changes for host-192-168-0-21.[mylocaldomain].local found but nothing.
The searchguard configuration on ES(node-2) is this:
searchguard.ssl.transport.enabled: true
searchguard.ssl.transport.keystore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/node-2-keystore.jks

searchguard.ssl.transport.truststore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/truststore.jks

logger.com.floragunn.searchguard.ssl: DEBUG

discovery.zen.ping.unicast.hosts: ["192.168.0.21"]
security.manager.enabled: false

searchguard.authcz.admin_dn:
- "CN=node-2.example.com, OU=SSL, O=Test, L=Test, C=DE"

Now both ES nodes are working but out of the cluster.

--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/fa060dec-c82f-409e-91d1-f93ed44a2b0e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/563CF595-567B-4720-8B57-A925CBCADF9A%40search-guard.com.
For more options, visit https://groups.google.com/d/optout.

Thank you, now other nodes joined the cluster after i disabled hostname verification :), disabling dns verification won’t be a security issue due to the truststore certificate verification?
My last question is, If i set this options on a node:
node.master: false
node.data: false
From the elasticsearch documentation i see that a client node can be used as a loadbalancer, do you know if SG have some performance impact when multiple requests come at the same time from different hosts?

···

Il giorno domenica 8 maggio 2016 03:19:54 UTC+2, SG ha scritto:

sorry, meant

searchguard.ssl.transport.enforce_hostname_verification: false

Am 08.05.2016 um 00:08 schrieb SG in...@search-guard.com:

try

searchguard.ssl.transport.enforce_hostname_verification: true

or

include host-192-168-0-21.[mylocaldomain].local in the san list in your certificates

(https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh line 35 and 49)

Am 07.05.2016 um 19:08 schrieb Sami Yessou yesso...@gmail.com:

Hello,

I’m trying to allow my other nodes join the Elasticsearch cluster protected with searchguard but when node-2 tries to join the cluster i get this errors(instead of my local domain there is [mylocaldomain]):

[2016-05-07 16:38:59,695][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event

[2016-05-07 16:39:01,174][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] connected to node [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}]

[2016-05-07 16:39:01,193][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] exception caught on transport layer [[id: 0x32507a86, /192.168.0.31:50464 => host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300]], closing connection

javax.net.ssl.SSLHandshakeException: General SSLEngine problem

at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)

at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)

at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)

at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)

at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)

at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)

at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)

at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)

at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)

at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)

at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)

at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)

at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)

at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)

at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)

at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)

at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)

at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)

at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)

at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)

at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)

at java.security.AccessController.doPrivileged(Native Method)

at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)

at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)

at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)

… 18 more

Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching host-192-168-0-21.[mylocaldomain].local found.

at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:204)

at sun.security.util.HostnameChecker.match(HostnameChecker.java:95)

at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)

at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)

at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)

at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)

… 26 more

[2016-05-07 16:39:01,196][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event

And on the node 1 logs i see:

[2016-05-07 16:39:01,137][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-1] exception caught on transport layer [[id: 0x2467bc1a, /192.168.0.31:50464 => /192.168.0.21:9300]], closing connection

javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)

at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)

at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)

at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800)

at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083)

at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907)

at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)

at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)

at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)

at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)

at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)

at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)

at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)

at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)

at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)

at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)

at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)

at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)

at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)

at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)

at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

at java.lang.Thread.run(Thread.java:745)

I have generated the certificates with example-pki-scripts/example.sh on node-1 then i copied the node-2-keystore.jks and trustore.jks on node-2 sgconfig , executed the sgadmin.sh to commit(no errors) the configuration and then restarted ES.

I am missing something to make the nodes joining?i have tried to edit /etc/hosts if something changes for host-192-168-0-21.[mylocaldomain].local found but nothing.

The searchguard configuration on ES(node-2) is this:

searchguard.ssl.transport.enabled: true

searchguard.ssl.transport.keystore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/node-2-keystore.jks

searchguard.ssl.transport.truststore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/truststore.jks

logger.com.floragunn.searchguard.ssl: DEBUG

discovery.zen.ping.unicast.hosts: [“192.168.0.21”]

security.manager.enabled: false

searchguard.authcz.admin_dn:

Now both ES nodes are working but out of the cluster.


You received this message because you are subscribed to the Google Groups “Search Guard” group.

To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.

To post to this group, send email to search...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/fa060dec-c82f-409e-91d1-f93ed44a2b0e%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.


You received this message because you are subscribed to the Google Groups “Search Guard” group.

To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.

To post to this group, send email to search...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/563CF595-567B-4720-8B57-A925CBCADF9A%40search-guard.com.

For more options, visit https://groups.google.com/d/optout.

SG should have no significant performance impact

···

Am 08.05.2016 um 13:32 schrieb Sami Yessou <yessou.sami@gmail.com>:

Thank you, now other nodes joined the cluster after i disabled hostname verification :), disabling dns verification won't be a security issue due to the truststore certificate verification?
My last question is, If i set this options on a node:
node.master: false
node.data: false
From the elasticsearch documentation i see that a client node can be used as a loadbalancer, do you know if SG have some performance impact when multiple requests come at the same time from different hosts?

Il giorno domenica 8 maggio 2016 03:19:54 UTC+2, SG ha scritto:
sorry, meant

searchguard.ssl.transport.enforce_hostname_verification: false

Am 08.05.2016 um 00:08 schrieb SG <in...@search-guard.com>:

try

searchguard.ssl.transport.enforce_hostname_verification: true

or

include host-192-168-0-21.[mylocaldomain].local in the san list in your certificates
(https://github.com/floragunncom/search-guard-ssl/blob/master/example-pki-scripts/gen_node_cert.sh line 35 and 49)

Am 07.05.2016 um 19:08 schrieb Sami Yessou <yesso...@gmail.com>:

Hello,
I'm trying to allow my other nodes join the Elasticsearch cluster protected with searchguard but when node-2 tries to join the cluster i get this errors(instead of my local domain there is [mylocaldomain]):
[2016-05-07 16:38:59,695][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event
[2016-05-07 16:39:01,174][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] connected to node [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}]
[2016-05-07 16:39:01,193][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] exception caught on transport layer [[id: 0x32507a86, /192.168.0.31:50464 => host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300]], closing connection
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)
at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1392)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1255)
... 18 more
Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching host-192-168-0-21.[mylocaldomain].local found.
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:204)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:95)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:252)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
... 26 more
[2016-05-07 16:39:01,196][DEBUG][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-2] disconnecting from [{#zen_unicast_1#}{192.168.0.21}{host-192-168-0-21.[mylocaldomain].local/192.168.0.21:9300}], channel closed event

And on the node 1 logs i see:

[2016-05-07 16:39:01,137][WARN ][com.floragunn.searchguard.ssl.transport.SearchGuardSSLNettyTransport] [node-1] exception caught on transport layer [[id: 0x2467bc1a, /192.168.0.31:50464 => /192.168.0.21:9300]], closing connection
javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1666)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1634)
at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1800)
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1083)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:907)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1218)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)

I have generated the certificates with example-pki-scripts/example.sh on node-1 then i copied the node-2-keystore.jks and trustore.jks on node-2 sgconfig , executed the sgadmin.sh to commit(no errors) the configuration and then restarted ES.
I am missing something to make the nodes joining?i have tried to edit /etc/hosts if something changes for host-192-168-0-21.[mylocaldomain].local found but nothing.
The searchguard configuration on ES(node-2) is this:
searchguard.ssl.transport.enabled: true
searchguard.ssl.transport.keystore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/node-2-keystore.jks

searchguard.ssl.transport.truststore_filepath: /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/truststore.jks

logger.com.floragunn.searchguard.ssl: DEBUG

discovery.zen.ping.unicast.hosts: ["192.168.0.21"]
security.manager.enabled: false

searchguard.authcz.admin_dn:
- "CN=node-2.example.com, OU=SSL, O=Test, L=Test, C=DE"

Now both ES nodes are working but out of the cluster.

--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.
To post to this group, send email to search...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/fa060dec-c82f-409e-91d1-f93ed44a2b0e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com.
To post to this group, send email to search...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/563CF595-567B-4720-8B57-A925CBCADF9A%40search-guard.com.
For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Search Guard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
To post to this group, send email to search-guard@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/search-guard/c0ba9968-2e39-4bf1-a4c8-879bfb2f93d7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.