# Wildcard for dns and ip in tlsconfig.yml

**URL:** <https://forum.search-guard.com/t/wildcard-for-dns-and-ip-in-tlsconfig-yml/1457>\
**Category:** Search Guard\
**Created:** [April 23, 2019, 10:46pm UTC](https://forum.search-guard.com/t/wildcard-for-dns-and-ip-in-tlsconfig-yml/1457 "2019-04-23T22:46:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![apsga](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@apsga](https://forum.search-guard.com/u/apsga)\
**Post date:** [April 23, 2019, 10:46pm UTC](https://forum.search-guard.com/t/wildcard-for-dns-and-ip-in-tlsconfig-yml/1457/1 "2019-04-23T22:46:20Z")

</div>

Elasticsearch Version: 5.6.15

Search Guard Version: 5.6.15-19.3

I was wondering if it was possible to use wildcards as part of the DNS/IP list in tlsconfig.yml

ex

```auto
nodes:
  - name: somenode
    dn: CN=somenode.onprem.com,OU=Ops,O=ES Ops,DC=somenode-onprem,DC=com
    dns:
    - blah-api
    - *-elasticsearch
    - es-*
    ip:
    - 100.107.65.*

```

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 24, 2019, 9:42am UTC](https://forum.search-guard.com/t/wildcard-for-dns-and-ip-in-tlsconfig-yml/1457/2 "2019-04-24T09:42:48Z")

</div>



---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [April 24, 2019, 9:44am UTC](https://forum.search-guard.com/t/wildcard-for-dns-and-ip-in-tlsconfig-yml/1457/3 "2019-04-24T09:44:48Z")

</div>

No, as per spec wildcards in IP addresses are not allowed:

> When the subjectAltName extension contains an iPAddress, the address MUST be stored in the octet string in “network byte order”, as specified in [RFC791]. The least significant bit (LSB) of each octet is the LSB of the corresponding byte in the network address. For IP version 4, as specified in [RFC791], the octet string MUST contain exactly four octets. For IP version 6, as specified in [RFC2460], the octet string MUST contain exactly sixteen octets.

( [RFC 5280](https://tools.ietf.org/html/rfc5280#page-36) )

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [May 15, 2019, 9:44am UTC](https://forum.search-guard.com/t/wildcard-for-dns-and-ip-in-tlsconfig-yml/1457/4 "2019-05-15T09:44:54Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.