How to handle ssl certs for remote cluster for reindex api?

Security
1

I am trying to use the reindex api to copy an index from a remote cluster into the local cluster. What is the process for adding the cert for the remote cluster in order to connect? I have tried added the remote CA and intermediary to the plugins.security.ssl.transport.pemtrustedcas_filepath and plugins.security.ssl.http.pemtrustedcas_filepath but no luck.

Any suggestion on getting connection to a remote cluster working?

Error when trying to run reindex

{
  "error" : {
    "root_cause" : [
      {
        "type" : "s_s_l_handshake_exception",
        "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
      }
    ],
    "type" : "s_s_l_handshake_exception",
    "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",
    "caused_by" : {
      "type" : "validator_exception",
      "reason" : "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target",
      "caused_by" : {
        "type" : "sun_cert_path_builder_exception",
        "reason" : "unable to find valid certification path to requested target"
      }
    }
  },
  "status" : 500
}
2

@ericallen Have you added remote certs on both sides? Both sides should contain local and remote CA certificates in one .pem file.

3

What is the configuration i need to use the installed cert? In elasticsearch it was reindex.ssl.truststore.path
What would be the equivalent of that?

4

What versions of OpenSearch do you use for remote and local clusters?

5

I am reindexing from elastic 8.7 to opensearch 1.2.0
The issue i have is that i have a cert i need to install. The cert is in my confimap but i dont know the parameter I need to set to point to the certificate

6

Hi @drosenst

Can you try to run the following command? Please use your user credentials that you used in the reindex request.

curl -k -u username:password -XGET "https://remote_cluster_hostname:9200/"

Also, please share your opensearch.yml and elasticsearch.yml.

7

Also, you need to concatenate all of the following into a single .pem file :

  1. the root-CA of the local cluster
  2. all the intermediate CAs of the local cluster
  3. the root-CA of the remote cluster
  4. all the intermediate CAs of the remote cluster

You can concatenate this into a single “chain.pem” file, for example. You will need to make this file available on both clusters.

8

what parameter do i set in the opensearch.yml to use the cert in reindex?
When i access the elasticsearch index i added the cert to my connection object in my python code.
So what i am trying to do is add the same pem to teh helm chart and then know what param to set in the opensearch.yml.
Thanks

9

Hi @drosenst

You can use reindex.ssl.truststore.path parameter in opensearch.yml.

Reindex API for OpenSearch 1.2 doesn’t work with the remote server ElasticSearch 8.7 in my lab. But Reindex API for OpenSearch 2.x works well with remote server ElasticSearch 8.7.

10

Thanks a lot for the reply

11

@Eugene7
I am still confused on how to make the file available on both the clusters?
I am using ElasticSearch 8.6.1 and Opensearch 2.12.0, what I am trying to do is to reindex the data from elasticsearch to opensearch and I am getting stuck into this error related to the certificate mismatch. Should I use the same certificates for both the elasticsearch and opensearch clusters? How should I solve this?

My ES is running on K8s and is being configured by the ES-K8s-operator, hence the certs for the elasticsearch and handled by the operator and the Opensearch is running in the same K8s cluster in another namespace and it is also configured via operator but is using the different certs which are not identical with the elasticsearch.

{"error":{"root_cause":[{"type":"s_s_l_handshake_exception","reason":"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"}],"type":"s_s_l_handshake_exception","reason":"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target","caused_by":{"type":"validator_exception","reason":"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target","caused_by":{"type":"sun_cert_path_builder_exception","reason":"unable to find valid certification path to requested target"}}},"status":500}```
12

@drosenst
Are you able to resolve this at your end? and what version of Elasticsearch and Opensearch you are having?