Self-signed certificate issue with Elasticsearch cluster

Search Guard
1

I used SearchGuard to encrypt nodes in ElasticSearch cluster following this guide

Master:

cluster.name: client1
searchguard.enterprise_modules_enabled: false


node.name: ekl.test.com
node.master: true
node.data: true
node.ingest: true


network.host: 0.0.0.0

#http.host: 0.0.0.0
network.publish_host: ["ekl1.test1.com","ekl.test.com"]



http.port: 9200


discovery.zen.ping.unicast.hosts: ["ekl.test.com", "ekl1.test1.com"]


discovery.zen.minimum_master_nodes: 1

xpack.security.enabled: false


searchguard.ssl.transport.pemcert_filepath: '/etc/elasticsearch/ssl/node1.pem'
searchguard.ssl.transport.pemkey_filepath: 'ssl/node1.key'
searchguard.ssl.transport.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.transport.resolve_hostname: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: '/etc/elasticsearch/ssl/node1_http.pem'
searchguard.ssl.http.pemkey_filepath: '/etc/elasticsearch/ssl/node1_http.key'
searchguard.ssl.http.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
searchguard.nodes_dn:
- CN=ekl.test.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
- CN=ekl1,test1.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
searchguard.authcz.admin_dn:
- CN=admin.test.com,OU=Ops,O=BugBear Com\, Inc.,DC=example,DC=com

Node:

cluster.name: client1
searchguard.enterprise_modules_enabled: false


node.name: ekl1.test.com
node.master: false
node.data: true
node.ingest: false


network.host: 0.0.0.0

#http.host: 0.0.0.0
network.publish_host: ["ekl1.test1.com","ekl.test.com"]



http.port: 9200


discovery.zen.ping.unicast.hosts: ["ekl.test.com", "ekl1.test1.com"]


discovery.zen.minimum_master_nodes: 1

xpack.security.enabled: false


searchguard.ssl.transport.pemcert_filepath: '/etc/elasticsearch/ssl/node2.pem'
searchguard.ssl.transport.pemkey_filepath: 'ssl/node2.key'
searchguard.ssl.transport.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.transport.resolve_hostname: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: '/etc/elasticsearch/ssl/node2_http.pem'
searchguard.ssl.http.pemkey_filepath: '/etc/elasticsearch/ssl/node2_http.key'
searchguard.ssl.http.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
searchguard.nodes_dn:
- CN=ekl.test.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
- CN=ekl1.test1.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
searchguard.authcz.admin_dn:
- CN=admin.test.com,OU=Ops,O=BugBear Com\, Inc.,DC=example,DC=com
Certificates are self-signed

From node i can telnet to ports 9200/9300 by hostnames

curl -kvX GET “https://admin:pass@ekl.test.com:9200” works fine (need to use -k to avoid cert verification because it’s self-signed)

Errors on node:

[ekl1.test1.com] not enough master nodes discovered during pinging (found , but needed 1), pinging again

Both server names are correct

I suspect issue is in self-signed certificate

If i specify IP instead of hostnames then getting:

Illegal parameter in http or transport request found. This means that one node is trying to connect to another with a non-node certificate (no OID or searchguard.nodes_dn incorrect configured) or that someone is spoofing requests.

ES Config path is /etc/elasticsearch [2019-03-28T21:25:56,450][INFO ][c.f.s.s.DefaultSearchGuardKeyStore] >[ekl1.test1.com] OpenSSL not available (this is not an error, we simply >fallback to built-in JDK SSL) because of java.lang.ClassNotFoundException: >io.netty.internal.tcnative.SSL

2

Found it: had to add to non-master:

transport.tcp.port: 9300
transport.host: ekl1.test1.com