# SSL Woes with OpenDistro on Docker **URL:** \ **Category:** Security\ **Created:** [August 19, 2020, 5:34pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546 "2020-08-19T17:34:17Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![lmurph](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lmurph](https://forum.opensearch.org/u/lmurph)\ **Post date:** [August 19, 2020, 5:34pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/1 "2020-08-19T17:34:17Z")
Hello all, I am setting up an OpenDistro cluster with Docker. My organization utilizes a single cert across all our VM’s of the form `*.domainname.com`. I am trying to use this cert and our CA for Elasticsearch transport / rest ssl encryption, kibana to elasticsearch encrypted, and logstash to elastic encrypted. Because we only have this one cert, I am using self-signed certs for the admin certs. The problem occurs when I try to enable hostname verification, which for us is a crucial security step. My SSL config on elasticsearch.yml: **opendistro\_security.ssl.transport.pemcert\_filepath: ‘\*.domainname.com.crt’** **opendistro\_security.ssl.transport.pemkey\_filepath: ‘\*.domainname.com.key’** **opendistro\_security.ssl.transport.pemtrustedcas\_filepath: ‘CAChain.pem’** **opendistro\_security.ssl.transport.enforce\_hostname\_verification: true** **opendistro\_security.ssl.http.enabled: true** **opendistro\_security.ssl.http.pemcert\_filepath: ‘\*.domainname.com.crt’** **opendistro\_security.ssl.http.pemkey\_filepath: ‘\*.dommainname.com.key’** **opendistro\_security.ssl.http.pemtrustedcas\_filepath: ‘CAChain.pem’** I’ve also confirmed that the admin and node dn’s are correct, though I won’t be posting them here for security. The same general setup is consistent across other parts of the stack: if I disable hostname verification the stack runs without an issue, if I enable it, Kibana / Logstash report that Elasticsearch is dead, and the Elastic nodes say they can’t verify their hostname on the transport layer. Any insight would be appreciated. ---
**Author:** ![Myonneutrino](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Myonneutrino](https://forum.opensearch.org/u/Myonneutrino)\ **Post date:** [August 24, 2020, 9:47am UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/2 "2020-08-24T09:47:23Z")
Hey lmurph, I’ve had a similiar problem. After some reasearch i found out that when the endpoints inside the docker containers try to verify the hostnames they use the containers’ ip addresses instead of their actual hostnames. I didn’t have the time yet to look further into this. If you found a solution or any more info on that could you please give an update? ---
**Author:** ![lmurph](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lmurph](https://forum.opensearch.org/u/lmurph)\ **Post date:** [August 24, 2020, 9:02pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/3 "2020-08-24T21:02:44Z")
Glad to know I’m not the only one! Haha. In the short term I won’t have time to look into this as well. For now I’m transitioning this deployment to bare metal, which is showing a lot more promise so far. I’ll be looking at it again eventually and update this thread. Feel free to do the same if you have time to look into it as well. I did come across a quick bit of info. If you define a custom network, Docker should switch from using IP’s to hostnames: [Use bridge networks | Docker Documentation](https://docs.docker.com/network/bridge/) However I’ve had a custom network from the beginning and it hasn’t worked thus far. ---
**Author:** ![lmurph](https://avatars.discourse-cdn.com/v4/letter/l/ac8455/32.png) [@lmurph](https://forum.opensearch.org/u/lmurph)\ **Post date:** [August 25, 2020, 4:14pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/4 "2020-08-25T16:14:18Z")
Kibana to Elastic and Logstash to Elastic is working much better on bare metal vs Docker. However I continue to have hostname verification issues on Elasticsearch on the transport layer. Wonder if it’s an issue with the wildcard? ---
**Author:** ![janstack](https://avatars.discourse-cdn.com/v4/letter/j/8dc957/32.png) [@janstack](https://forum.opensearch.org/u/janstack)\ **Post date:** [January 2, 2021, 3:23pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/5 "2021-01-02T15:23:28Z")
Encountering the same issue : getting a `java.security.cert.CertificateException: No subject alternative names matching IP address` error due to Docker containers having always a different IP. ---
**Author:** ![janstack](https://avatars.discourse-cdn.com/v4/letter/j/8dc957/32.png) [@janstack](https://forum.opensearch.org/u/janstack)\ **Post date:** [January 2, 2021, 3:32pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/6 "2021-01-02T15:32:45Z")
My solution was to add the following line to `elasticsearch.yml` : ```auto opendistro_security.ssl.transport.enforce_hostname_verification: false ``` ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [May 31, 2021, 5:32pm UTC](https://forum.opensearch.org/t/ssl-woes-with-opendistro-on-docker/3546/7 "2021-05-31T17:32:33Z")
@lmurph It seems to do with wildcard indeed, did you specifying the full cert name?