OpenSearch Transport Auth/Auth no longer supported - still attempts handshake on 9300

OpenSearch
,
1

I’m trying to setup an OpenSearch cluster and I’m having an issue adding in a second node. I keep getting the OpenSearchException[Transport client authentication no longer supported.] error on the master node logs and [2022-06-09T16:28:42,799][WARN ][o.o.d.HandshakingTransportAddressConnector] [ngfs-data-ctc] handshake failed for [connectToRemoteMasterNode[XXX.XXX.XXX.XXX:9300]] on the data node. Is there something specific in the config files that I should be changing? Below is what they look like currently:

# --------------------------------- Discovery ----------------------------------
#
network.host: ngfs-frontend.bldc.XXX.XXX.XXX
discovery.seed_hosts: [ "ngfs-frontend.bldc.XXX.XXX.XXX", "ngfs-data.ctc.XXX.XXX.XXX" ]
cluster.initial_master_nodes: ['ngfs-frontend-bldc', 'ngfs-data-ctc']
#
# ---------------------------------- Various -----------------------------------
#
#
# --------------------- OpenSearch Security Configuration ----------------------
#
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/certificates/fullchain
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/certificates/privkey
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/certificates/root-ca-combined.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
#
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/certificates/fullchain
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/certificates/privkey
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/certificates/root-ca.pem

I saw this article mentioning the removal of support as of 2.x but even though all hosts are on 2.0, they seem to still run into this issue.

Thanks in advance!

2

We got stuck in the same situation when we were trying to send query from an OS 1.3 cluster to an OS 2.0 cluster.

3

So what ended up being the issue for me was that the certificate subject names for the TLS transport on each node was not matching the plugins.nodes_dn information I had. Fixing that solved the issue - though it would’ve been useful if the error were to say that that was the issue.