Graylog2 / Graylog2/graylog2-server

Option to skip SSL Hostname Verification

Open
#19,773 0 comments 1 reaction 0 assignees View on GitHub
feature
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

Similarly to OpenSearch/ElasticSearch's security plugins, I'd like an option to disable SSL Hostname verification to work around this issue.

## Expected Behavior

An optional config setting to disable hostname verification, so nodes can communicate via TLS without IP SANs in the certificate.

## Current Behavior
```log
2024-06-28 05:00:11,703 WARN [ProxiedResource] - Failed to call API on node , cause: Hostname 10.42.7.19 not verified:
certificate: sha256/...
DN:
subjectAltNames: [graylog.cluster.local] (duration: 186 ms) - {}
```
## Possible Solution
An additional optional config setting, that when enabled, configures OkHttpClient with a HostnameVerifier that does not verify the IP SANs of the TLS certificate.

## Context
I'm running Graylog in kubernetes with the [helm chart ](https://github.com/KongZ/charts/tree/main/charts/graylog)
and I'd like to use TLS, but when making API calls between nodes, the calls fail due to the way my certs are setup.

I'm using cert-manager to provision certificates, and because these pods are running in kubernetes, I can't assign IP SANs to the certificates, since the node IPs change. The Helm chart sets node communication via the IPs.

## Your Environment

* Graylog Version: 5.2.6
* Helm Chart v2.3.8
* Java Version:
* OpenSearch Version: 2.14.0
* MongoDB Version: 6.0.4
* Operating System:
* Browser version:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.