{"action":"opened","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/35","repository_url":"https://api.github.com/repos/floragunncom/search-guard-ssl","labels_url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/35/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/35/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/35/events","html_url":"https://github.com/floragunncom/search-guard-ssl/issues/35","id":172944537,"number":35,"title":"SGS transport fails because of hostname resolution in AWS ","user":{"login":"pdstefan","id":3641148,"avatar_url":"https://avatars.githubusercontent.com/u/3641148?v=3","gravatar_id":"","url":"https://api.github.com/users/pdstefan","html_url":"https://github.com/pdstefan","followers_url":"https://api.github.com/users/pdstefan/followers","following_url":"https://api.github.com/users/pdstefan/following{/other_user}","gists_url":"https://api.github.com/users/pdstefan/gists{/gist_id}","starred_url":"https://api.github.com/users/pdstefan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pdstefan/subscriptions","organizations_url":"https://api.github.com/users/pdstefan/orgs","repos_url":"https://api.github.com/users/pdstefan/repos","events_url":"https://api.github.com/users/pdstefan/events{/privacy}","received_events_url":"https://api.github.com/users/pdstefan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-08-24T12:57:49Z","updated_at":"2016-08-24T12:57:49Z","closed_at":null,"body":"Hello everyone, \r\nHere goes nothing : \r\n\r\nSearch-Guard-SSL version=2.3.5.15\r\nES : Version: 2.3.5, Build: 90f439f/2016-07-27T10:36:52Z, JVM: 1.8.0_31\r\n\r\nJVM : \r\njava version \"1.8.0_31\"\r\nJava(TM) SE Runtime Environment (build 1.8.0_31-b13)\r\nJava HotSpot(TM) 64-Bit Server VM (build 25.31-b07, mixed mode)\r\n\r\nOS :Official Ubuntu 14.04 LTS AMI in **AWS** \r\n\r\nDev Cluster with 2 nodes. \r\n\r\nDescription of the bug : \r\n\r\nSGS uses the incorrect hostname to connect and this causes the connection to fail with \"javax.net.ssl.SSLHandshakeException: General SSLEngine problem\". Upon enabling debug we can see that the hostname is the PTR record , not the A/CNAME DNS entry. \r\nThis seems to happen because searchguard.ssl.transport.enforce_hostname_verification and searchguard.ssl.transport.resolve_hostname are set to true (by default). \r\n\r\n\r\n\r\nSteps to reproduce : \r\n1) Launch 2 official Ubuntu 14.04 LTS in AWS (ami-d05e75b8 in us-east1). Once booted change the hostname of the instances. \r\n2) Install and configure ES (we use chef)\r\n3) Generate self-signed CA and use that to sign node certificates (we followed the steps listed in the example scripts)\r\n4) Install SGS and configure it : \r\nsearchguard.ssl.http.enabled: false\r\nsearchguard.ssl.transport.enabled: true\r\nsearchguard.ssl.transport.enforce_hostname_verification: true\r\nsearchguard.ssl.transport.keystore_filepath: /etc/elasticsearch/searchguard.ssl/test-cata01.test.customer.1ux.it_elasticsearch.jks\r\nsearchguard.ssl.transport.keystore_password: waivih4Yah7ahy5eingesh7zei%D9qua\r\nsearchguard.ssl.transport.keystore_type: JKS\r\nsearchguard.ssl.transport.truststore_filepath: /etc/elasticsearch/searchguard.ssl/truststore.jks\r\nsearchguard.ssl.transport.truststore_password: waivih4Yah7ahy5eingesh7zei%D9qua\r\nsearchguard.ssl.transport.truststore_type: JKS\r\n5) Restart ES nodes. \r\n\r\nLogs : \r\nhttp://pastebin.com/VMGattUs\r\n\r\nLet me know if there is anything else I can help with. \r\nThanks, \r\n=Stefan\r\n"}}
{"actor":{"display_login":"pdstefan"}}