While setting up Search Guard SSL, you're required to set up several keystores and SSL certificates. Several scripts are provided by Search Guard SSL, in this directory: example-pki-scripts.
In one of the provided scripts the following command is run:
$ keytool -genkey \ -alias $NODE_NAME \ -keystore $NODE_NAME-keystore.jks \ -keyalg RSA \ -keysize 2048 \ -validity 712 \ -sigalg SHA256withRSA \ -keypass $KS_PASS \ -storepass $KS_PASS \ -dname "CN=$NODE_NAME.example.com, OU=SSL, O=Test, L=Test, C=DE" \ -ext san=dns:$NODE_NAME.example.com,dns:localhost,ip:127.0.0.1,oid:188.8.131.52.5.5 #oid:184.108.40.206.5.5 denote this a server node certificate for search guard
I've not encountered the use of
oid:XXXX before in the
-ext switch to
- Is the use of a
oid:here the recommended way to go here?
- Is it secure to use an
oid:XXXhere, it seems like security through obscurity?
- Where does the number sequence for
oid:come from, is it just arbitrary?