Elasticsearch certificate not creating with subjectAltNames

[shipler]

When trying to work with elasticsearch i'm getting an error due to the fact that when SO creating the elasticsearch certificate is missing the subjectAltNames key/value.
I can't use the do not verify option.

Is it possible to add the ssl init.sls subjectAltNames with the node name?
I think it should be: -addext "subjectAltName = DNS:foo.co.uk"

As mentioned in Section 6 of RFC 6125 [1], the certificate hostname should no longer be extracted from the distinguished name (DN), but rather explicitly enumerated as one or more subject alternate names (SAN)

[shipler]

Is there a way i can recreate the certificates easily and the SO will continue to work properly? although im pretty sure this will not affect since all the plugins ignore the certificate verification...

[TOoSmOotH]

Take a look at https://github.com/Security-Onion-Solutions/securityonion/blob/master/salt/ssl/init.sls#L342

You should be able to add something similar to the elasticserach.crt section. It "should" generate a new cert but if not just delete the old one. ES will probably need to be restarted as well. Also keep in mind that every soup will overwrite these changes so it will need to be added back.

[shipler]

Thanks!! I will give it a try