0

My environment consists of 2 docker containers, one running Logstash and another running Elasticsearch on the SAME host & SAME docker network. I am trying to setup SSL between the 2 of them (this is because Elasticsearch needs SSL and can be reached out to by sources outside the network, thus Logstash also needs to communicate with Elasticsearch via SSL). Since I’m testing this out I’m using self signed certificates.

I have been running into various issues as far as configuration is concerned, I only have 1 pair of SSL key & certificate which I’m using across my dev/test environment.

Here’s what my elasticsearch configuration looks like

[root@hdp100:~ (default)]$ docker exec -it elastic_default bash -c "cat /usr/share/elasticsearch/config/elasticsearch.yml"
    network.host: 0.0.0.0
    node.roles: [ data, master ]
    cluster.name: "docker-cluster"
    discovery.type: single-node
    # Enable security features
    xpack.security.enabled: true
    xpack.security.authc.realms.file.file1.order: 0
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.key: /usr/share/elasticsearch/config/security/logstore_server.key
    xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/security/logstore_server.crt

Here's what my output section looks like for logstash

output {
  if [kubernetes] {
     if [kubernetes][labels][adcomponent] {
          elasticsearch {
           user => “test"
           password => “pass@word"
           hosts => ["https://ad-elastic:9200"]
           manage_template => false
           index => "kubernetes-logs-%{[kubernetes][labels][adcomponent]}-%{+yyyy.MM.dd}"
           ssl_enabled => true
           cacert => ["/usr/share/logstash/config/security/logparse_server.crt"]
         }
     }
     else {
        elasticsearch {
         user => “test"
         password => “pass@word"
         hosts => ["https://ad-elastic:9200"]
         manage_template => false
         index => "kubernetes-logs-kubernetes-%{+yyyy.MM.dd}"
         ssl_enabled => true
         cacert => ["/usr/share/logstash/config/security/logparse_server.crt"]
       }
     }
   }
}

I keep getting the following error in logstash, ad-elastic resolves to the IP of the docker container running elastic.

[2024-02-14T09:51:57,824][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"https://test:xxxxxx@ad-elastic:9200/", :exception=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [https://ad-elastic:9200/][Manticore::UnknownException] Certificate for doesn't match any of the subject alternative names: [vm001.sre.test.dev, *.sre.test.dev]"}

What is the right way to configure SSL here ? Should I be looking into using truststore ?

3
  • Certificates need to be a) issued by a CA trusted by the client and b) match the expectation of the client regarding the content of the certificate. The latter typically means that the subject/SAN of the certificate must match the domain used by the client to access it. The error message indicates that this is not the case with the certificate you use: it is valid for vm001.sre.test.dev, *.sre.test.dev but you use it for ad-elastic. Feb 14 at 6:15
  • so in case of docker containers where containers connect to each other what should the name of the subjects be ? these are self signed certificates that I'm using, I'm not entirely sure if there is some standard practice for configuring ssl between containers. Feb 14 at 7:48
  • 1
    Again, the name in the certificates should reflect the name you use to access these systems - so check what names are used to access. This requirement has nothing to do with certificate being self-signed or not. Self-signed is only about the issuer of the certificate which also must be trusted by the client (i.e. another requirement in addition to subject). Feb 14 at 8:33

0

You must log in to answer this question.

Browse other questions tagged .