Is it possible to check against the CN (Common Name) or SAN (Subject Alternative Names) of each and every certificate in the certificate chain for a match ? I have 2 docker containers hosted on my VM, one of the containers (Logstash) connects to the other (ElasticSearch DB) and SSL is enabled for ElasticSearch DB.

Logstash writes its output to ElasticSearch but references it via the docker container name but the certificates being used for SSL contain the hostname of the VM.

I wanted to chain a self signed certificate bearing the container name to the certificate belonging to the host, this way I'm hoping that ad-logstash doesn't fail as it checks the CN of the self signed certificate and all external entities check the CN or SAN further up the certificate chain.

Is something like this possible ?

  • 2
    This does not make much sense to me. You cannot "chain" a self-signed certificate in top of a leaf-certificate (i.e. no CA) and then the rest of the chain. What you need to do instead is to verify the existing certificate against the hostname you expect, i.e. even if the certificate is for the public name and you access it by the docker name you should verify it using the public name as expected. How this is done your setup is unknown to me, but what you propose is even more strange. You could also have the certificate contain both the public name and the docker name as SAN. Feb 23 at 12:18
  • WRT I wanted to chain a self signed certificate - herein lies the problem. If a certificate is self-signed, then it cannot be chained to another certificate. For a certificate to be part of a chain, it needs to be signed by the next certificate up in the chain, it cannot be self-signed.
    – mti2935
    Feb 23 at 12:18
  • Welcome to the community. You need your own CA. Elastic includes an OpenSSL wrapper script which takes care of these matters for you, you might need to specify the --dns flag. Feb 23 at 16:52


You must log in to answer this question.

Browse other questions tagged .