Handling multidomain certifiates

[pablo]

@stecino. You have to add DN of admin certificate to the admin_dn.

https://opensearch.org/docs/latest/security/configuration/tls/#configuring-node-certificates

Then you can use admin cert and key with every API call using curl or other client. Please keep in mind that the admin cert is very powerful and should be used only for security settings management.

If your admin cert was signed by a different RootCA than the nodes then you must add that RootCA to the file defined in the plugins.security.ssl.transport.pemtrustedcas_filepath and plugins.security.ssl.http.pemtrustedcas_filepath.

Replace DEMO SSL certificate for Production CA DigiCert wildcard

@fdinardo That should be correct. You should see the node’s certificate signed by the Intermediate certificate. Did you verify the files inside the containers? Do you get the correct openserach.yml and cert/key files in both OpenSearch containers? Have you noticed any read file permission errors in the OpenSearch logs during the startup? Did you add the RootCA of the admin certificate to the root-ca.pem? If the RootCAs are different then the root-ca.pem should look like the below example. -…