SSL Certificate Hostname Verification Issue with Graylog in Docker Environment about docker-compose

[snab]

similar here. steps to reproduce:

1. run "sudo docker-compose up" for the open-core variant
2. enroll the datanode incl certs. PWD from the output of "sudo docker-compose up"
3. stop the docker: "sudo docker-compose down"
4. try to spin it up again
   between different approaches I observed missmatching certs from the datanode:

datanode_1  | 2024-01-04T18:11:45.368Z WARN  [OpensearchNodeHeartbeat] Opensearch REST api of process 81 unavailable. Cause: Host name '1138565ce5e2' does not match the certificate subject provided by the peer (CN=f90a0c432f93)
datanode_1  | 2024-01-04T18:13:27.852Z WARN  [OpensearchNodeHeartbeat] Opensearch REST api of process 81 unavailable. Cause: Host name '9c86f23e4940' does not match the certificate subject provided by the peer (CN=f90a0c432f93)

this lead me to the fix: add a line with a named hostname for the datanode:

[...]
  datanode:
    hostname: "opensearch" 
    image: "${DATANODE_IMAGE:-graylog/graylog-datanode:5.2}"
[...]

As you now have messed certs for your datanode clean all your data (including your logs so far!) with
sudo docker-compose down -v
and start from scratch, if you are in a lab environment.

[janheise]

thx @snab for pointing that out.

@hsh-it - although @snab's solution is for the DataNode, sth similar should work for your Elastic setup. Try adding a hostname to the service and add it to the SubjectAltnames when you create your certificates. I guess you also should configure the elasticsearch_hosts configuration string to use these new hostnames to connect. Let me know if this works for you.

If you use he DataNode - your docker-compose.yml snippet hints at an ES 7.10 config - snab's suggestion should be all you need.

[hsh-it]

This fixed my issue! Thank you very much :)