# Securityadmin error when initializing the cluster

**URL:** https://forum.opensearch.org/t/securityadmin-error-when-initializing-the-cluster/22324
**Category:** Security
**Tags:** discuss, troubleshoot, configure, security-issue
**Created:** [November 7, 2024, 1:56am UTC](https://forum.opensearch.org/t/securityadmin-error-when-initializing-the-cluster/22324 "2024-11-07T01:56:07Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![yeonghyeonKo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/yeonghyeonko/32/8202_2.png) [@yeonghyeonKo](https://forum.opensearch.org/u/yeonghyeonKo)
#### Post date: [November 7, 2024, 5:51am UTC](https://forum.opensearch.org/t/securityadmin-error-when-initializing-the-cluster/22324/2 "2024-11-07T05:51:31Z")

</div>

## Self-Answering

- By comparing two opensearch.yml (Cluster **A** ’s certificates are created by cert-manager and the other Cluster **B** ’s are by operator), I found that `authcz.admin_dn` and `nodes_dn` settings are different.

```yaml
# Cluster A : test-opensearch-cluster-1
security:
    tls:
      transport:
        generate: false
        perNode: false
        secret: 
          name: test-opensearch-cluster-1-transport-cert
        caSecret:
          name: test-opensearch-cluster-1-ca
        nodesDn: [CN=test-opensearch-cluster-1,OU=test-opensearch-cluster-1]
        adminDn: [CN=admin,OU=test-opensearch-cluster-1]
      http:
        generate: false
        secret:
          name: test-opensearch-cluster-1-http-cert

```

```yaml
# Cluster B : test-opensearch-cluster-2
security:
    tls:
      transport:
        generate: true
        perNode: true
      http:
        generate: true

```

* * *

As printing two opensearch.yml, DNs for the former have been splitted by double-quotes but the latter’s have been combined with a single double-quote. (See the below:)

```auto
$ k get cm test-opensearch-cluster-1-config -o yaml | grep plugins.security.nodes_dn --context=3
    plugins.security.authcz.admin_dn: ["CN=admin","OU=test-opensearch-cluster-1"]
    plugins.security.check_snapshot_restore_write_privileges: true
    plugins.security.enable_snapshot_restore_privilege: true
    plugins.security.nodes_dn: ["CN=test-opensearch-cluster-1","OU=test-opensearch-cluster-1"]
    plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
    plugins.security.ssl.http.enabled: true
    plugins.security.ssl.http.pemcert_filepath: tls-http/tls.crt

$ k get cm test-opensearch-cluster-2-config -o yaml -n test-opensearch-cluster-2 | grep plugins.security.nodes_dn --context=3
    plugins.security.authcz.admin_dn: ["CN=admin,OU=test-opensearch-cluster-2"]
    plugins.security.check_snapshot_restore_write_privileges: true
    plugins.security.enable_snapshot_restore_privilege: true
    plugins.security.nodes_dn: ["CN=test-opensearch-cluster-2,OU=test-opensearch-cluster-2"]
    plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
    plugins.security.ssl.http.enabled: true
    plugins.security.ssl.http.pemcert_filepath: tls-http/tls.crt

```

### Today’s Lesson

- Watch OUT **Array** type and **Double Quot** e in yaml (Especially, If you use a single transport certificate across nodes.)

---

_[View the full topic](https://forum.opensearch.org/t/securityadmin-error-when-initializing-the-cluster/22324)._