{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/curator/issues/792","repository_url":"https://api.github.com/repos/elastic/curator","labels_url":"https://api.github.com/repos/elastic/curator/issues/792/labels{/name}","comments_url":"https://api.github.com/repos/elastic/curator/issues/792/comments","events_url":"https://api.github.com/repos/elastic/curator/issues/792/events","html_url":"https://github.com/elastic/curator/issues/792","id":185199393,"number":792,"title":"curator 4.1.2 fails to validate ssl connection ","user":{"login":"nellicus","id":8770097,"avatar_url":"https://avatars.githubusercontent.com/u/8770097?v=3","gravatar_id":"","url":"https://api.github.com/users/nellicus","html_url":"https://github.com/nellicus","followers_url":"https://api.github.com/users/nellicus/followers","following_url":"https://api.github.com/users/nellicus/following{/other_user}","gists_url":"https://api.github.com/users/nellicus/gists{/gist_id}","starred_url":"https://api.github.com/users/nellicus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nellicus/subscriptions","organizations_url":"https://api.github.com/users/nellicus/orgs","repos_url":"https://api.github.com/users/nellicus/repos","events_url":"https://api.github.com/users/nellicus/events{/privacy}","received_events_url":"https://api.github.com/users/nellicus/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":14,"created_at":"2016-10-25T18:38:19Z","updated_at":"2016-10-26T15:51:51Z","closed_at":null,"body":"curator version\r\n```\r\nuser@host /opt/elk/prod/common/curator $ curator --version\r\ncurator, version 4.1.2\r\n```\r\n\r\npython version \r\n```\r\nuser@host /opt/elk/prod/common/curator $ python --version\r\nPython 3.5.2\r\n```\r\n\r\ncurator config\r\n```\r\nuser@host /opt/elk/prod/common/curator $ cat prod.config \r\nclient:\r\n  hosts:\r\n    - 192.168.1.105\r\n  port: 9200\r\n  url_prefix:\r\n  use_ssl: True\r\n  certificate: /opt/elk/prod/SSL/ca/certs/cacert.pem\r\n  client_cert:\r\n  client_key:\r\n  ssl_no_validate: False \r\n  http_auth: curator:xxxxxxx\r\n  timeout: 30\r\n  master_only: False\r\n\r\nlogging:\r\n  loglevel: INFO\r\n  logfile:\r\n  logformat: default\r\n  blacklist: ['elasticsearch', 'urllib3']\r\n```\r\n\r\ncurator action\r\n```\r\nuser@host /opt/elk/prod/common/curator $ cat delete_all_last_21d.action \r\n---\r\n# Remember, leave a key empty if there is no value.  None will be a string,\r\n# not a Python \"NoneType\"\r\n#\r\n# Also remember that all examples have 'disable_action' set to True.  If you\r\n# want to use this action as a template, be sure to set this to False after\r\n# copying it.\r\nactions:\r\n  1:\r\n    action: delete_indices\r\n    description: >-\r\n      Delete indices older than 45 days (based on index name), for logstash-\r\n      prefixed indices. Ignore the error if the filter does not result in an\r\n      actionable list of indices (ignore_empty_list) and exit cleanly.\r\n    options:\r\n      ignore_empty_list: True\r\n      timeout_override:\r\n      continue_if_exception: False\r\n      disable_action: False \r\n    filters:\r\n    - filtertype: pattern\r\n      kind: prefix\r\n      value: logstash-syslog-\r\n      exclude:\r\n    - filtertype: pattern\r\n      kind: prefix\r\n      value: .security_audit_log-\r\n      exclude:\r\n    - filtertype: age\r\n      source: name\r\n      direction: older\r\n      timestring: '%Y.%m.%d'\r\n      unit: days\r\n      unit_count: 21 \r\n      exclude:\r\n```\r\n\r\nexecution\r\n```\r\nuser@host /opt/elk/prod/common/curator $ curator --config prod.config delete_all_last_21d.action  --dry-run\r\n2016-10-25 19:49:18,135 INFO      Preparing Action ID: 1, \"delete_indices\"\r\n/opt/elasticsearch-curator/library.zip/urllib3/util/ssl_.py:334: SNIMissingWarning: An HTTPS request has been made, but the SNI (Subject Name Indication) extension to TLS is not available on this platform. This may cause the server to present an incorrect TLS certificate, which can cause validation failures. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings\r\n/opt/elasticsearch-curator/library.zip/urllib3/util/ssl_.py:132: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings\r\n/opt/elasticsearch-curator/library.zip/urllib3/util/ssl_.py:132: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings\r\n/opt/elasticsearch-curator/library.zip/urllib3/util/ssl_.py:132: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings\r\n/opt/elasticsearch-curator/library.zip/urllib3/util/ssl_.py:132: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#ssl-warnings\r\nTraceback (most recent call last):\r\n  File \"/home/vagrant/.local/lib/python2.7/site-packages/cx_Freeze/initscripts/Console.py\", line 27, in <module>\r\n  File \"run_curator.py\", line 8, in <module>\r\n  File \"/tmp/curator/curator-4.1.2/curator/curator.py\", line 5, in main\r\n  File \"/home/vagrant/.local/lib/python2.7/site-packages/click/core.py\", line 716, in __call__\r\n  File \"/home/vagrant/.local/lib/python2.7/site-packages/click/core.py\", line 696, in main\r\n  File \"/home/vagrant/.local/lib/python2.7/site-packages/click/core.py\", line 889, in invoke\r\n  File \"/home/vagrant/.local/lib/python2.7/site-packages/click/core.py\", line 534, in invoke\r\n  File \"/tmp/curator/curator-4.1.2/curator/cli.py\", line 165, in cli\r\n  File \"/tmp/curator/curator-4.1.2/curator/utils.py\", line 587, in get_client\r\nelasticsearch.exceptions.ElasticsearchException: Unable to create client connection to Elasticsearch.  Error: ConnectionError(hostname u'192.168.1.105' doesn't match either of 'w530', '192.168.1.105', 'w530', 'my.public.fqdn', 'localhost', '127.0.0.1') caused by: SSLError(hostname u'192.168.1.105' doesn't match either of 'w530', '192.168.1.105', 'w530', 'my.public.fqdn', 'localhost', '127.0.0.1')\r\n```\r\n\r\ninterestingly:\r\n\r\n```\r\nError: ConnectionError(hostname u'192.168.1.105' doesn't match either of 'w530', '192.168.1.105', 'w530', 'my.public.fqdn.sanitized', 'localhost', '127.0.0.1') caused by: SSLError(hostname u'192.168.1.105' doesn't match either of 'w530', '192.168.1.105', 'w530', 'my.public.fqdn.sanitized', 'localhost', '127.0.0.1')\r\n```\r\n\r\nRootCA cert\r\n```\r\nuser@host /opt/elk/prod/common/curator $ openssl x509 -in /opt/elk/prod/SSL/ca/certs/cacert.pem -text -noout\r\nCertificate:\r\n    Data:\r\n        Version: 3 (0x2)\r\n        Serial Number: 18225851306593748419 (0xfcef3b32da9c05c3)\r\n    Signature Algorithm: sha256WithRSAEncryption\r\n        Issuer: CN=\"Elasticsearch Test RootCA\"\r\n        Validity\r\n            Not Before: Oct 24 08:39:34 2016 GMT\r\n            Not After : Oct 24 08:39:34 2017 GMT\r\n        Subject: CN=\"Elasticsearch Test RootCA\"\r\n        Subject Public Key Info:\r\n            Public Key Algorithm: rsaEncryption\r\n                Public-Key: (2048 bit)\r\n                Modulus:\r\n                    00:c9:cc:7c:57:2c:6d:8e:5c:e9:41:7e:14:d9:45:\r\n                    fa:d8:f0:8f:dd:9f:46:90:c0:91:2e:9a:e9:a5:33:\r\n                    6c:a0:89:c4:80:04:75:26:83:08:0e:42:9b:a6:71:\r\n                    fc:52:f5:25:b3:2d:43:4a:b2:63:8f:e3:37:c7:ef:\r\n                    d6:5a:f4:26:4f:7a:f7:63:c9:77:0a:53:a6:52:19:\r\n                    3b:29:01:3f:17:8c:5c:0d:6f:79:53:10:fa:93:02:\r\n                    19:57:b5:0d:b1:af:41:a1:54:ab:75:e2:50:86:dc:\r\n                    78:81:0d:2f:1d:1c:14:22:b3:82:d6:6a:1f:63:1a:\r\n                    76:06:85:81:49:08:09:ee:45:b6:a4:e8:c1:fe:7e:\r\n                    26:b0:ae:38:97:a9:a6:c8:9f:1b:97:ed:69:7a:c6:\r\n                    fa:60:5c:61:e2:a9:95:bf:60:7f:99:3e:4f:c1:6c:\r\n                    43:cc:c5:ae:de:92:0d:96:ce:4a:e4:1a:ce:d3:40:\r\n                    15:df:20:b4:0d:65:6b:3d:a5:85:96:2a:ca:fd:fb:\r\n                    cb:9e:4a:89:42:32:92:86:5e:2d:3a:6e:f7:24:4b:\r\n                    77:78:7e:52:2f:84:7c:da:ed:1c:58:64:91:58:e5:\r\n                    91:da:20:7e:3b:64:84:45:f8:1e:ef:b4:22:4b:7d:\r\n                    7e:a5:15:bb:b3:47:45:ce:d7:11:15:21:30:e4:90:\r\n                    40:2d\r\n                Exponent: 65537 (0x10001)\r\n        X509v3 extensions:\r\n            X509v3 Basic Constraints: \r\n                CA:TRUE\r\n            X509v3 Subject Key Identifier: \r\n                21:A7:76:E7:76:2E:29:7D:66:C6:39:67:20:8B:6C:A8:18:0C:5E:7F\r\n            X509v3 Authority Key Identifier: \r\n                keyid:21:A7:76:E7:76:2E:29:7D:66:C6:39:67:20:8B:6C:A8:18:0C:5E:7F\r\n                DirName:/CN=\"Elasticsearch Test RootCA\"\r\n                serial:FC:EF:3B:32:DA:9C:05:C3\r\n\r\n    Signature Algorithm: sha256WithRSAEncryption\r\n         83:77:d9:66:01:32:80:80:3b:84:2c:89:c8:33:ba:e9:c1:83:\r\n         d9:95:35:84:27:e8:e7:d5:66:8e:31:69:04:49:12:83:9c:3f:\r\n         f9:79:09:27:ff:6b:62:71:56:d8:46:65:4b:37:f1:6a:fd:9b:\r\n         99:a5:9c:49:8a:2e:37:ad:f5:43:90:2d:04:03:35:84:55:ec:\r\n         6f:e7:db:19:cf:b2:14:81:23:40:ed:b2:3c:95:6c:c8:9b:c4:\r\n         35:f9:f5:68:de:0d:35:ac:f5:21:a3:06:8f:8a:d9:43:0d:88:\r\n         d2:e6:19:0c:cc:8c:e4:07:20:e8:61:43:26:2b:ec:f0:6d:8a:\r\n         dc:e5:03:a3:63:12:49:fe:1b:20:39:21:0c:ed:33:18:81:55:\r\n         7e:d9:dc:93:86:d6:2b:4d:26:56:d5:d3:06:76:e1:d3:a6:66:\r\n         aa:c9:ae:f7:bd:84:b5:74:cf:4d:aa:34:c8:ea:1c:77:c1:87:\r\n         b8:e3:1a:4e:a6:31:a9:4a:ac:85:4e:38:1f:00:99:de:80:3d:\r\n         a4:b6:28:33:33:98:31:6d:93:6c:c5:4e:73:87:7c:48:dc:2a:\r\n         5d:3b:e0:2f:56:30:ea:03:61:fc:ac:44:53:9f:04:69:77:0e:\r\n         34:69:9f:98:c9:9d:97:ba:4d:93:85:84:2f:06:c3:a1:35:f4:\r\n         26:d4:bf:55\r\n\r\n```\r\n\r\ncurl to same cluster\r\n```\r\nuser@host /opt/elk/prod/common/curator $ curl -XGET --cacert /opt/elk/prod/SSL/ca/certs/cacert.pem https://192.168.1.105:9200 -v -u elastic\r\nEnter host password for user 'elastic':\r\nNote: Unnecessary use of -X or --request, GET is already inferred.\r\n* Rebuilt URL to: https://192.168.1.105:9200/\r\n*   Trying 192.168.1.105...\r\n* Connected to 192.168.1.105 (192.168.1.105) port 9200 (#0)\r\n* found 1 certificates in /opt/elk/prod/SSL/ca/certs/cacert.pem\r\n* found 704 certificates in /etc/ssl/certs\r\n* ALPN, offering http/1.1\r\n* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_CBC_SHA1\r\n* \t server certificate verification OK\r\n* \t server certificate status verification SKIPPED\r\n* \t common name: w530 (matched)\r\n* \t server certificate expiration date OK\r\n* \t server certificate activation date OK\r\n* \t certificate public key: RSA\r\n* \t certificate version: #3\r\n* \t subject: CN=w530\r\n* \t start date: Mon, 24 Oct 2016 08:40:46 GMT\r\n* \t expire date: Tue, 24 Oct 2017 08:40:46 GMT\r\n* \t issuer: CN=\\\"Elasticsearch Test RootCA\\\"\r\n* \t compression: NULL\r\n* ALPN, server did not agree to a protocol\r\n* Server auth using Basic with user 'elastic'\r\n> GET / HTTP/1.1\r\n> Host: 192.168.1.105:9200\r\n> Authorization: Basic ZWxhc3RpYzpyMW5nM3I=\r\n> User-Agent: curl/7.47.0\r\n> Accept: */*\r\n> \r\n< HTTP/1.1 200 OK\r\n< content-type: application/json; charset=UTF-8\r\n< content-length: 320\r\n< \r\n{\r\n  \"name\" : \"node1\",\r\n  \"cluster_name\" : \"tony\",\r\n  \"cluster_uuid\" : \"pxIuh0V7Sw2DQzlJ0SVQtg\",\r\n  \"version\" : {\r\n    \"number\" : \"5.0.0-rc1\",\r\n    \"build_hash\" : \"13e62e1\",\r\n    \"build_date\" : \"2016-10-07T16:52:58.798Z\",\r\n    \"build_snapshot\" : false,\r\n    \"lucene_version\" : \"6.2.0\"\r\n  },\r\n  \"tagline\" : \"You Know, for Search\"\r\n}\r\n* Connection #0 to host 192.168.1.105 left intact\r\n\r\n```\r\n\r\nam I missing anything?"},"comment":{"url":"https://api.github.com/repos/elastic/curator/issues/comments/256392337","html_url":"https://github.com/elastic/curator/issues/792#issuecomment-256392337","issue_url":"https://api.github.com/repos/elastic/curator/issues/792","id":256392337,"user":{"login":"untergeek","id":1020383,"avatar_url":"https://avatars.githubusercontent.com/u/1020383?v=3","gravatar_id":"","url":"https://api.github.com/users/untergeek","html_url":"https://github.com/untergeek","followers_url":"https://api.github.com/users/untergeek/followers","following_url":"https://api.github.com/users/untergeek/following{/other_user}","gists_url":"https://api.github.com/users/untergeek/gists{/gist_id}","starred_url":"https://api.github.com/users/untergeek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untergeek/subscriptions","organizations_url":"https://api.github.com/users/untergeek/orgs","repos_url":"https://api.github.com/users/untergeek/repos","events_url":"https://api.github.com/users/untergeek/events{/privacy}","received_events_url":"https://api.github.com/users/untergeek/received_events","type":"User","site_admin":false},"created_at":"2016-10-26T15:51:51Z","updated_at":"2016-10-26T15:51:51Z","body":"Cool.  Thanks for helping me test on one more platform.  I feel confident moving forward with the binary package solution now.  Feel free to close this if you're satisfied."}}
{"actor":{"display_login":"untergeek"}}