Graylog2 / Graylog2/graylog2-server
Option to skip SSL Hostname Verification
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
Similarly to OpenSearch/ElasticSearch's security plugins, I'd like an option to disable SSL Hostname verification to work around this issue.
## Expected Behavior
An optional config setting to disable hostname verification, so nodes can communicate via TLS without IP SANs in the certificate.
## Current Behavior
```log
2024-06-28 05:00:11,703 WARN [ProxiedResource] - Failed to call API on node , cause: Hostname 10.42.7.19 not verified:
certificate: sha256/...
DN:
subjectAltNames: [graylog.cluster.local] (duration: 186 ms) - {}
```
## Possible Solution
An additional optional config setting, that when enabled, configures OkHttpClient with a HostnameVerifier that does not verify the IP SANs of the TLS certificate.
## Context
I'm running Graylog in kubernetes with the [helm chart ](https://github.com/KongZ/charts/tree/main/charts/graylog)
and I'd like to use TLS, but when making API calls between nodes, the calls fail due to the way my certs are setup.
I'm using cert-manager to provision certificates, and because these pods are running in kubernetes, I can't assign IP SANs to the certificates, since the node IPs change. The Helm chart sets node communication via the IPs.
## Your Environment
* Graylog Version: 5.2.6
* Helm Chart v2.3.8
* Java Version:
* OpenSearch Version: 2.14.0
* MongoDB Version: 6.0.4
* Operating System:
* Browser version:
Contributor guide
Assessment
This issue has not been assessed yet.