From 087eb93139d661dbaa72637d1bdb8663940b95cb Mon Sep 17 00:00:00 2001 From: Tomas Dvorak Date: Thu, 5 Oct 2023 08:04:17 +0200 Subject: [PATCH] Re-enable hostname verification in opensearch #16219 (#16810) --- .../variants/OpensearchSecurityConfiguration.java | 5 ----- 1 file changed, 5 deletions(-) diff --git a/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java b/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java index e932cbfd5b..7e0600c12c 100644 --- a/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java +++ b/data-node/src/main/java/org/graylog/datanode/configuration/variants/OpensearchSecurityConfiguration.java @@ -111,11 +111,6 @@ public class OpensearchSecurityConfiguration { config.put("plugins.security.ssl.transport.truststore_filepath", TRUSTSTORE_FILENAME); config.put("plugins.security.ssl.transport.truststore_password", truststore.passwordAsString()); - // this disables hostname verification for transport. It's a workaround for localnode communication - // via SSL, where Opensearch still tries to communicate with 'localhost' and not the publish_host or other - // configured node names. - config.put("plugins.security.ssl.transport.enforce_hostname_verification", "false"); - config.put("plugins.security.ssl.http.enabled", "true"); config.put("plugins.security.ssl.http.keystore_type", KEYSTORE_FORMAT);