opensearch security - regex in plugins.security.nodes_dn

125 views Asked by Dmitry Perfilyev At 14 September 2024 at 14:13

opensearch-2.11.0

forum.opensearch.org complains that my question has more than 2 links (WHY) and rejects my question, so I ask here

Hello, please, help me to configure plugins.security.nodes_dn as regexp. I have 2 node certificates with subjects:

Subject: C=CT, ST=City, L=City, O=ORG, OU=admins, CN=node1-elk.org
Subject: C=CT, ST=City, L=City, O=ORG, OU=admins, CN=node2-elk.org

I try to set plugins.security.nodes_dn as described in documentation "Configuring admin certificates"

plugins.security.nodes_dn:
   - '/CN=node[0-9]-elk.org/'

But this doesn't work and I get " Transport client authentication no longer supported" error like described here

After changing plugins.security.nodes_dn to exact list of certs:

plugins.security.nodes_dn :
  - 'CN=node1-elk.org,OU=admins,O=ORG,L=City,ST=City,C=CT'
  - 'CN=node2-elk.org,OU=admins,O=ORG,L=City,ST=City,C=CT'

everything works fine.

I don't want list every cert for every node and want to use regex, what i'm doing wrong?

TechQA.