# Seems you use a client certificate but this one is not registered as admin\_dn **URL:** \ **Category:** Search Guard\ **Created:** [December 8, 2022, 1:07pm UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377 "2022-12-08T13:07:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hello4usharath](https://avatars.discourse-cdn.com/v4/letter/h/97f17d/32.png) [@hello4usharath](https://forum.search-guard.com/u/hello4usharath)\ **Post date:** [December 8, 2022, 1:07pm UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377/1 "2022-12-08T13:07:10Z")
Am getting error while running sgadmin. **Elasticsearch version:** 7.17 **Server OS version:** centos **Describe the issue:** WARNING: JAVA\_HOME not set, will use /bin/java Search Guard Admin v7 Will connect to localhost:9300 … done Connected as CN=admin,OU=IT,O=xxxxx,L=Palo Alto,ST=California,C=US ERR: CN=admin,OU=IT,O=xxxxx,L=xxxx,ST=California,C=US is not an admin user Seems you use a client certificate but this one is not registered as admin\_dn Make sure elasticsearch.yml on all nodes contains: ```auto searchguard.authcz.admin_dn: - "CN=admin,OU=IT,O=xxx,L=Palo Alto,ST=California,C=US" ``` **Steps to reproduce:** 1.sh sgadmin.sh -cd …/sgconfig/ -key /elastic/software/elasticsearch-7.17.7/config//certificate/admin-key.pem -cert /elastic/software/elasticsearch-7.17.7/config//certificate/admin.pem -cacert /elastic/software/elasticsearch-7.17.7/config//certificate/root-ca.pem -nhnv -icl 2. 3. **Provide configuration:** ```auto searchguard.ssl.transport.pemkey_filepath: /elastic/software/elasticsearch-7.17.7/config/certificate/node1-key.pem searchguard.ssl.transport.pemtrustedcas_filepath: /elastic/software/elasticsearch-7.17.7/config/certificate/root-ca.pem searchguard.ssl.transport.enforce_hostname_verification: false searchguard.ssl.http.enabled: true searchguard.ssl.http.pemcert_filepath: /elastic/software/elasticsearch-7.17.7/config/certificate/node1.pem searchguard.ssl.http.pemkey_filepath: /elastic/software/elasticsearch-7.17.7/config/certificate/node1-key.pem searchguard.ssl.http.pemtrustedcas_filepath: /elastic/software/elasticsearch-7.17.7/config/certificate/root-ca.pem searchguard.allow_unsafe_democertificates: false searchguard.allow_default_init_sgindex: true searchguard.authcz.admin_dn: - CN=admin,OU=IT,O=xxxxx,L=Palo Alto,C=US searchguard.enable_snapshot_restore_privilege: true searchguard.check_snapshot_restore_write_privileges: true searchguard.restapi.roles_enabled: ["SGS_ALL_ACCESS"] searchguard.nodes_dn: - 'CN=bldafinsgt-stg-es1.xxxxx.com,OU=IT,O=xxxx,L=Palo Alto,C=US' - 'CN=*.vmware.com,OU=IT,O=xxxx,L=Palo Alto,C=US' - 'CN=bldafinsgt-stg-es1*' - '/CN=.*regex/' ``` ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [December 8, 2022, 4:49pm UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377/2 "2022-12-08T16:49:09Z")
@hello4usharath How many Elasticsearch nodes do you have in your cluster and what is the version of the SG plugin? ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [December 8, 2022, 6:06pm UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377/3 "2022-12-08T18:06:02Z")
@hello4usharath In the Error message you have ```auto CN=admin,OU=IT,O=xxxxx,L=xxxx,ST=California,C=US ``` but in elasticsearch.yml ```auto CN=admin,OU=IT,O=xxxxx,L=Palo Alto,C=US ``` Is the **L** in the certificate’s DN the same as in admin\_dn? (Palo Alto) Also as per above, you’re missing **ST=California** in the admin\_dn. Both admin\_dn and certificate’s subject have to be an exact match. ---
**Author:** ![hello4usharath](https://avatars.discourse-cdn.com/v4/letter/h/97f17d/32.png) [@hello4usharath](https://forum.search-guard.com/u/hello4usharath)\ **Post date:** [December 9, 2022, 12:20pm UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377/4 "2022-12-09T12:20:43Z")
[alerting][plugins] Error executing alerting apiKey invalidation task: no permissions for [indices:data/read/search] and User sg\_anonymous [backend\_roles=[sg\_anonymous\_backendrole]]: security\_exception: [security\_exception] Reason: no permissions for [indices:data/read/search] and User sg\_anonymous [backend\_roles=[sg\_anonymous\_backendrole]] [elasticsearch@bldafinsgt-stg-es1 bin]$ curl -k [https://blda-stg-es1:9200/\_searchguard/authinfo?pretty](https://blda-stg-es1:9200/_searchguard/authinfo?pretty) { “user” : “User sg\_anonymous [backend\_roles=[sg\_anonymous\_backendrole]]”, “user\_name” : “sg\_anonymous”, “user\_requested\_tenant” : null, “remote\_address” : “x.x.x.x:53862”, “backend\_roles” : [ “sg\_anonymous\_backendrole” ], “custom\_attribute\_names” : , “attribute\_names” : , “sg\_roles” : [ “SGS\_OWN\_INDEX”, “sg\_anonymous” ], “sg\_tenants” : { “sg\_anonymous” : true }, “principal” : null, “peer\_certificates” : “0”, “sso\_logout\_url” : null } ---
**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/pablo/32/1443_2.png) [@pablo](https://forum.search-guard.com/u/pablo)\ **Post date:** [December 12, 2022, 9:17am UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377/5 "2022-12-12T09:17:43Z")
@hello4usharath Have you got securityadmin.sh running? Did you fix admin\_dn in elasticsearch.yml? What’s the other error regards? This looks like a separate issue. ---
**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\ **Post date:** [January 2, 2023, 9:18am UTC](https://forum.search-guard.com/t/seems-you-use-a-client-certificate-but-this-one-is-not-registered-as-admin-dn/2377/6 "2023-01-02T09:18:11Z")
Closed on January 2, 2023, 9:18am UTC This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.