# Apply configuration changes using securityadmin.sh

**URL:** <https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499>\
**Category:** Security\
**Tags:** install\
**Created:** [February 3, 2022, 5:44am UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499 "2022-02-03T05:44:32Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![sharath](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@sharath](https://forum.opensearch.org/u/sharath)\
**Post date:** [February 3, 2022, 5:44am UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/1 "2022-02-03T05:44:32Z")

</div>

5:42:46.421 [opensearch[_client_][transport\_worker][T#1]] ERROR org.opensearch.security.ssl.transport.SecuritySSLNettyTransport - Exception during establishing a SSL connection: javax.net.ssl.SSLHandshakeException: No name matching localhost found  
javax.net.ssl.SSLHandshakeException: No name matching localhost found  
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]  
at sun.security.ssl.TransportContext.fatal(TransportContext.java:369) ~[?:?]  
at sun.security.ssl.TransportContext.fatal(TransportContext.java:312) ~[?:?]  
at sun.security.ssl.TransportContext.fatal(TransportContext.java:307) ~[?:?]  
at sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357) ~[?:?]  
at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232) ~[?:?]  
at sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175) ~[?:?]  
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396) ~[?:?]  
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480) ~[?:?]  
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1267) ~[?:?]  
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1254) ~[?:?]  
at java.security.AccessController.doPrivileged(AccessController.java:691) ~[?:?]  
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1199) ~[?:?]  
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1548) ~[netty-handler-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1394) ~[netty-handler-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1235) ~[netty-handler-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1284) ~[netty-handler-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:507) ~[netty-codec-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:446) ~[netty-codec-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-codec-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:655) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:581) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-transport-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:986) [netty-common-4.1.69.Final.jar:4.1.69.Final]  
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.69.Final.jar:4.1.69.Final]  
at java.lang.Thread.run(Thread.java:832) [?:?]  
Caused by: java.security.cert.CertificateException: No name matching localhost found  
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:234) ~[?:?]  
at sun.security.util.HostnameChecker.match(HostnameChecker.java:103) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:452) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:426) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:292) ~[?:?]  
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144) ~[?:?]  
at sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335) ~[?:?]  
… 30 more  
ERR: Cannot connect to OpenSearch. Please refer to opensearch logfile for more information  
Trace:  
NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{EJBNZeC\_StqP\_vEAwBr\_fQ}{localhost}{127.0.0.1:9300}]]  
at org.opensearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:381)  
at org.opensearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:272)  
at org.opensearch.client.transport.TransportProxyClient.execute(TransportProxyClient.java:79)  
at org.opensearch.client.transport.TransportClient.doExecute(TransportClient.java:484)  
at org.opensearch.client.support.AbstractClient.execute(AbstractClient.java:433)  
at org.opensearch.client.support.AbstractClient.execute(AbstractClient.java:419)  
at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:524)  
at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:157)

Script : ./securityadmin.sh -cd …/securityconfig/ -icl-nhnv -cacert …/…/…/config/certs/root-ca.pem -cert …/…/…/config/certs/admin.pem -key …/…/…/config/certs/admin-key.pem

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/ce8ac13d2832d14a0ca50cb417138e80fe9e2168.png)

---

<div class="post-metadata">

**Author:** ![sharath](https://avatars.discourse-cdn.com/v4/letter/s/b3f665/32.png) [@sharath](https://forum.opensearch.org/u/sharath)\
**Post date:** [February 3, 2022, 5:47am UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/2 "2022-02-03T05:47:58Z")

</div>

I have rectified the issue and solved the problem.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [February 3, 2022, 2:05pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/3 "2022-02-03T14:05:04Z")

</div>

@sharath thanks for the update. The securityadmin.sh by default connects with localhost. -h option allows choosing Elasticsearch hostname.

The hostname must match CN or SAN of Elastisearch’s SSL certificate

---

<div class="post-metadata">

**Author:** ![Simon](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@Simon](https://forum.opensearch.org/u/Simon)\
**Post date:** [August 29, 2023, 8:23am UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/4 "2023-08-29T08:23:43Z")

</div>

hi @sharath how did you fix it？i have the same trouble.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [August 29, 2023, 4:31pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/5 "2023-08-29T16:31:06Z")

</div>

@Simon Please open a new thread and share your securityadmin.sh command and the output.

---

<div class="post-metadata">

**Author:** ![Simon](https://avatars.discourse-cdn.com/v4/letter/s/f07891/32.png) [@Simon](https://forum.opensearch.org/u/Simon)\
**Post date:** [August 31, 2023, 9:33am UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/6 "2023-08-31T09:33:02Z")

</div>

hi @pablo thx for your reply.

> [@./securityadmin.sh ERR: An unexpected IOException occured: Unrecognized SSL message, plaintext connection?](https://forum.opensearch.org/t/securityadmin-sh-err-an-unexpected-ioexception-occured-unrecognized-ssl-message-plaintext-connection/15731):
>
> Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): opensearch 2.9 Describe the issue: [opensearch@e245aacc23f5 tools]$ ./securityadmin.sh -icl-nhnv -cacert …/…/…/config/root-ca.pem -cert …/…/…/config/admin.pem -key …/…/…/config/admin-key.pem \*\* This tool will be deprecated in the next major release of OpenSearch \*\* \*\* [[DEPRECATION] Security Plugin Tools will be replaced · Issue #1755 · opensearch-project/security · GitHub](https://github.com/opensearch-project/security/issues/1755) \*\* Security Admin v7 Will connect to localh…

---

<div class="post-metadata">

**Author:** ![lgrullonbb](https://avatars.discourse-cdn.com/v4/letter/l/e99b99/32.png) [@lgrullonbb](https://forum.opensearch.org/u/lgrullonbb)\
**Post date:** [November 11, 2025, 4:16pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/7 "2025-11-11T16:16:37Z")

</div>

> [@./securityadmin.sh ERR: An unexpected IOException occured: Unrecognized SSL message, plaintext connection?](https://forum.opensearch.org/t/securityadmin-sh-err-an-unexpected-ioexception-occured-unrecognized-ssl-message-plaintext-connection/15731/1):
>
> ./securityadmin.sh -icl-nhnv

I adjusted my password via hash.sh, but I am not able to updat the backend…it keeps giving me an error related to SSL, even when I am using plain http. Please advise.

```auto
./securityadmin.sh -icl-nhnv -cacert /etc/opensearch/root-ca.pem -cert /etc/opensearch/kirk.pem -key /etc/opensearch/kirk-key.pem -h 10.123.80.97 Security Admin v7
Will connect to 10.123.80.97:9200 ... done
ERR: An unexpected IOException occured: Unrecognized SSL message, plaintext connection?
Trace:
java.io.IOException: Unrecognized SSL message, plaintext connection?
        at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:1348)
        at org.opensearch.client.RestClient.performRequest(RestClient.java:371)
        at org.opensearch.client.RestClient.performRequest(RestClient.java:359)
        at org.opensearch.security.tools.SecurityAdmin.execute(SecurityAdmin.java:541)
        at org.opensearch.security.tools.SecurityAdmin.main(SecurityAdmin.java:154)
Caused by: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
        at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:145)
        at java.base/sun.security.ssl.SSLEngineInputRecord.bytesInCompletePacket(SSLEngineInputRecord.java:64)
        at java.base/sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:610)
        at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:504)
        at java.base/sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:480)
        at java.base/javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:673)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:336)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:392)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession.access$100(SSLIOSession.java:74)
        at org.apache.hc.core5.reactor.ssl.SSLIOSession$1.inputReady(SSLIOSession.java:203)
        at org.apache.hc.core5.reactor.InternalDataChannel.onIOEvent(InternalDataChannel.java:143)
        at org.apache.hc.core5.reactor.InternalChannel.handleIOEvent(InternalChannel.java:51)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.processEvents(SingleCoreIOReactor.java:176)
        at org.apache.hc.core5.reactor.SingleCoreIOReactor.doExecute(SingleCoreIOReactor.java:125)
        at org.apache.hc.core5.reactor.AbstractSingleCoreIOReactor.execute(AbstractSingleCoreIOReactor.java:92)
        at org.apache.hc.core5.reactor.IOReactorWorker.run(IOReactorWorker.java:44)
        at java.base/java.lang.Thread.run(Thread.java:1447)

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 11, 2025, 11:00pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/8 "2025-11-11T23:00:09Z")

</div>

> [@lgrullonbb](#):
>
> `Unrecognized SSL message, plaintext connection?`

Hi @lgrullonbb, as per the error message securityadmin.sh expects SSL at 9200. It will fail to communicate with HTTP.

Which of these works in your environment?

```auto
curl --insecure -u admin:<password> https://10.123.80.97:9200

```

or

```auto
curl http://10.123.80.97:9200

```

---

<div class="post-metadata">

**Author:** ![lgrullonbb](https://avatars.discourse-cdn.com/v4/letter/l/e99b99/32.png) [@lgrullonbb](https://forum.opensearch.org/u/lgrullonbb)\
**Post date:** [November 17, 2025, 2:16pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/9 "2025-11-17T14:16:21Z")

</div>

> [@pablo](#):
>
> `curl http://10.123.80.97:9200`

I am guetting the following output via curl:

```auto
curl http://10.123.80.97:9200
{
  "name" : "node1",
  "cluster_name" : "bsi-prd-cluster",
  "cluster_uuid" : "VDRQagj5RFa82Ug_BtHnQQ",
  "version" : {
    "distribution" : "opensearch",
    "number" : "3.3.2",
    "build_type" : "rpm",
    "build_hash" : "6564992150e26aaa62d4522a220dfff5188aeb88",
    "build_date" : "2025-10-29T22:24:10.265134377Z",
    "build_snapshot" : false,
    "lucene_version" : "10.3.1",
    "minimum_wire_compatibility_version" : "2.19.0",
    "minimum_index_compatibility_version" : "2.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

```

When I tried the same via https, I am getting the following:

```auto
curl --insecure -u admin:password https://10.123.80.97:9200
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 17, 2025, 2:56pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/10 "2025-11-17T14:56:09Z")

</div>

@lgrullonbb Did you disable security plugin in this OpenSearch cluster?

---

<div class="post-metadata">

**Author:** ![lgrullonbb](https://avatars.discourse-cdn.com/v4/letter/l/e99b99/32.png) [@lgrullonbb](https://forum.opensearch.org/u/lgrullonbb)\
**Post date:** [November 17, 2025, 3:05pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/11 "2025-11-17T15:05:18Z")

</div>

Yes, I have the security plugin disable

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 17, 2025, 8:13pm UTC](https://forum.opensearch.org/t/apply-configuration-changes-using-securityadmin-sh/8499/12 "2025-11-17T20:13:39Z")

</div>

@lgrullonbb So how do you want to update the security configuration with securityadmin.sh script when that plugin is disabled?

Security plugin must be enabled, with HTTP SSL set to true.

```auto
plugins.security.ssl.http.enabled: true

```