SSL certificate problem for Notification

Plugins Alerting
1

Hello
In Opensearch 2.17 I have a problem with creating a webhook channel. In case of using HTTPS (example httpS://alert.domain.com/wh.php)
I get an error:

[status_exception] {"event_status_list": [{"config_id":"XdjKR5MB69D4v3TSNEjk","config_type":"webhook","config_name":"test","email_recipient_status":[],"delivery_status":{"status_code":"500","status_text":"Failed to send webhook message PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"}}]}

However, if on Opensearch nodes I use a curl with the CA certificate specified from the config, then everything works without errors.

[root@elk-master]# curl -vv --cacert /etc/opensearch/CA.cer https://alert.domain.com/wh.php
...
< HTTP/2 200
...

In config:

[root@elk-master]# cat /etc/opensearch/opensearch.yml | grep ssl.http
plugins.security.ssl.http.enabled: true 
plugins.security.ssl.http.pemcert_filepath: node.cer 
plugins.security.ssl.http.pemkey_filepath: node.key
plugins.security.ssl.http.pemtrustedcas_filepath: CA.cer

If I use the HTTP protocol, then the alerts work fine.

Please tell me what certificates Notification uses and is it possible to change them somehow?

2

@mouse Is this a self signed certificate?

Similar issue has been reported in the OpenSearch GitHub

3

@pablo No, this is a certificate issued by a single certification center of the company. It is used, among other things, for the operation of LDAP, so it is guaranteed to be included in the trusted ones for all nodes of the company.

4

@mouse Was it signed by the external Certificate Authority? If not, then your rootCA is still self-signed. The fact that you must place the rootCA in each node means that rootCA is not well known CA.

Could you check this solution? Placing your root CA in Java’s keystore may solve your issue.

1 Like
5

@pablo, You are right, our certificate is not signed by an external one.
The solution with placing the certificate in the Java keystore helped.
I have a large cluster (65 nodes), but it is not necessary to place it on all nodes. Only need to do this for those nodes that the OSD works (“opensearch.hosts” in “opensearch_dashboards.yml”)

UPDATE this only for check from OSD interface. Scheduler task will be executed on one (maybe random?) of the cluster nodes (from me - one master node, not active). That’s why it’s better to placing the certificate on all nodes.

Thank you very much for your help.

1 Like