From eeb3d57e5fd5f8f659dde13070688245c66e0809 Mon Sep 17 00:00:00 2001 From: Paris Larkins Date: Fri, 17 Jan 2025 13:52:48 +1100 Subject: [PATCH] Update hot reload documentation to show how DN validation can be skipped Signed-off-by: Paris Larkins --- _security/configuration/tls.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/_security/configuration/tls.md b/_security/configuration/tls.md index a4115b8c25..0943a2fdb5 100755 --- a/_security/configuration/tls.md +++ b/_security/configuration/tls.md @@ -272,7 +272,15 @@ Updating expired or nearly expired TLS certificates does not require restarting This setting is `false` by default. {: .note } -After enabling hot reloading, use the Reload Certificates API to replace the expired certificates. The API expects the old certificates to be replaced with valid certificates issued with the same `Issuer/Subject DN` and `SAN`. The new certificates also need be stored in the same location as the previous certificates in order to prevent any changes to the `opensearch.yml` file. +After enabling hot reloading, use the Reload Certificates API to replace the expired certificates. The new certificates need to be stored in the same location as the previous certificates in order to prevent any changes to the `opensearch.yml` file. +By default, the API expects the old certificates to be replaced with valid certificates issued with the same `Issuer/Subject DN` and `SAN`. This behaviour can be disabled by adding the following settings in `opensearch.yml`: + +``` +plugins.security.ssl.http.enforce_cert_reload_dn_verification: false +plugins.security.ssl.transport.enforce_cert_reload_dn_verification: false +``` + +These settings are `true` by default. Only a [superadmin]({{site.url}}{{site.baseurl}}/security/configuration/tls/#configuring-admin-certificates) can use the Reload Certificates API. {: .note }