Is absen optino: ssl_certificate_verification

For connection to ES need add option ssl_certificate_verification(true/false). Now when ES use self singin cacert there is ssl connection error.

    if options['ca_certs']:
        es_client = Elasticsearch(es_cluster,
                                  verify_certs=True,
                                  ca_certs=options['ca_certs'],
                                  client_cert=options['client_cert'],
                                  client_key=options['client_key'],
                                  headers=options['header'],
                                  http_auth=http_auth)
    else:
        es_client = Elasticsearch(es_cluster,
                                  verify_certs=False,
                                  headers=options['header'],
                                  http_auth=http_auth)

and need disable host_verification .

[braedon]

Can you post the exact logs you get when running that command with the original code (i.e. verify_certs=True)?

What happens if you run:

--log-level DEBUG -e https://elasticsearch:9200 --basic-password password --basic-user user --cluster-health-disable --nodes-stats-disable --indices-mappings-disable --indices-stats-disable

i.e. remove the --ca-certs option, which should disable verify_certs.

Were your instance certs generated with IPs or DNS names? i.e. were the --ip and/or --dns options of the elasticsearch-certutil cert command specified?

[braedon]

Hi @zakabluk,

As stated above, my best guess for how to connect to a cluster that has HTTPS enabled but doesn’t have correctly configured certificates is to use a HTTPS URL without any --ca-certs.

For a self-signed cluster, you should be able to just specify a HTTPS URL in --es-cluster, and not specify --ca-certs - that should use a HTTPS connection, but set verify_certs=False (i.e. use the else block in the code you posted).

What happens if you run:

--log-level DEBUG -e https://elasticsearch:9200 --basic-password password --basic-user user --cluster-health-disable --nodes-stats-disable --indices-mappings-disable --indices-stats-disable

i.e. remove the --ca-certs option, which should disable verify_certs.

I don’t know if this works or not, as I don’t have access to your cluster, and don’t have enough information about your cluster to replicate (nor do I have the time to do so).

As previously requested, if this doesn’t work, please post the resulting logs so I can see what is happening.

Otherwise, I’d suggest configuring your cluster with SSL certificates that can pass hostname verification - i.e. set --ip and/or --dns.