Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch → 2.16.0 Dashboard → 2.3.0 Describe the issue: OpenSearch cluster is not working after swtich from opensearch self-generated certificates to SSL certificates. It was working perfectly fine using the default opensearch se…

@GTGabaaron , Is this issue the same as the one discussed in the following topic? [image] OpenSearch not creating admin-cert after removing http on tls block Security Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.16.0 and 2.17.0 Describe the issue: I’…

Hello @Eugene7 , apologies for the late reply. Not, its not related. It is a side installation using self-generated certificates but I’m still on the road to install it using SSL certificates. I’ve installed OpenSearch using the operator. Pablo has helped me to clarify something related to the TLS b…

To check your certificates, could you please share the output of the following commands? Please remove or change sensitive data. openssl x509 -in <your-node-certificate-name> -text -noout openssl x509 -in <your-root-ca-name> -text -noout Have you added the configuration for the REST layer as per…

Hi @Eugene7 you can find the outcome below. Please note that the values for C, ST and O were auto-generated by openssl command, I only provided the OU and CN following the examples from the values in the OpenSearch self-generated certs. NODES Certificate Certificate: Data: Version: 3…

@GTGabaaron , Did you create CA certificate separately for both transport layer of nodes and http connection? (by the help of @pablo ) because bootstrap.StartupException will be happed from o.s.s.DefaultSecurityKeyStore.initTransportSSLConfig if you set like the below: # opensearchcluster kind (…

Hi @yeonghyeonKo no, I only created two certificates, one for the admin and another one for the transport nodes following this guide ( Generating self-signed certificates - OpenSearch Documentation ). However, looking at your snipped code, looks like that I missed to include the security.http.generat…

I got a new message with more details, this one comes from the security pod stating that “I’m not using an admin certificate but a client one”. Is there any additional step that I need to do to register as an actual “admin” certificate? [image]

@GTGabaaron This regards admin_dn in opensearch.yml. It must match the exact certificate DN. Please follow the suggestion returned by the script.

[image] OpenSearch not creating admin-cert after removing http on tls block Security Hi, @GTGabaaron @pablo Did you define ConfigMap also? Being true for security.tls.http.generate (and transport) makes ConfigMap named <cluster-name>-config. Also, it means that you have…

Hi @pablo , actually the values in the opensearch.yml are now matching the ones in the error message. I updated them after include the security.tls.http.generate=false block mentioned by @yeonghyeonKo . @yeonghyeonKo question here, I used the same transport-nodes certificate for the security.tls.htt…

OpenSearch is not working after provide SSL certificates

Security

yeonghyeonKo October 11, 2024, 1:53am 11

@pablo , I commented how we can overwrite opensearch.yml using ConfigMap in K8s container environment. Will it be helpful in @GTGabaaron 's case?

Topic		Replies	Views
K8s: Define SSL certificates via secrets Security configure	38	5261	June 4, 2024
SSL doesn't work OpenSearch	26	1259	February 20, 2026
SSL Error unable to configure Opensearch Cluster in 6 VMs Security troubleshoot , configure	14	1773	March 8, 2023
Issue with OpenSearch dashboard TLS Configuration Security troubleshoot	14	2374	June 1, 2023
When installing opensearch, am getting error like failed to load plugin class for securtiy plugin Security	22	11336	January 29, 2024

OpenSearch is not working after provide SSL certificates

Related topics