title: not enough master nodes discovered during pinging - Elasticsearch cluster self signed certificate
body: <p>I used SearchGuard to encrypt nodes in ElasticSearch cluster following <a href="https://gryzli.info/2018/12/01/elasticsearchelk-stack-security-howto/" rel="nofollow noreferrer">this guide</a></p>
  
  <p>Master:</p>
  
  <pre><code>cluster.name: client1
  searchguard.enterprise_modules_enabled: false
  
  
  node.name: ekl.test.com
  node.master: true
  node.data: true
  node.ingest: true
  
  
  network.host: 0.0.0.0
  
  #http.host: 0.0.0.0
  network.publish_host: ["ekl1.test1.com","ekl.test.com"]
  
  
  
  http.port: 9200
  
  
  discovery.zen.ping.unicast.hosts: ["ekl.test.com", "ekl1.test1.com"]
  
  
  discovery.zen.minimum_master_nodes: 1
  
  xpack.security.enabled: false
  
  
  searchguard.ssl.transport.pemcert_filepath: '/etc/elasticsearch/ssl/node1.pem'
  searchguard.ssl.transport.pemkey_filepath: 'ssl/node1.key'
  searchguard.ssl.transport.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
  searchguard.ssl.transport.enforce_hostname_verification: false
  searchguard.ssl.transport.resolve_hostname: false
  searchguard.ssl.http.enabled: true
  searchguard.ssl.http.pemcert_filepath: '/etc/elasticsearch/ssl/node1_http.pem'
  searchguard.ssl.http.pemkey_filepath: '/etc/elasticsearch/ssl/node1_http.key'
  searchguard.ssl.http.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
  searchguard.nodes_dn:
  - CN=ekl.test.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
  - CN=ekl1.test1.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
  searchguard.authcz.admin_dn:
  - CN=admin.test.com,OU=Ops,O=BugBear Com\, Inc.,DC=example,DC=com
  </code></pre>
  
  <p>Node:</p>
  
  <pre><code>cluster.name: client1
  searchguard.enterprise_modules_enabled: false
  
  
  node.name: ekl1.test.com
  node.master: false
  node.data: true
  node.ingest: false
  
  
  network.host: 0.0.0.0
  
  #http.host: 0.0.0.0
  network.publish_host: ["ekl1.test1.com","ekl.test.com"]
  
  
  
  http.port: 9200
  
  
  discovery.zen.ping.unicast.hosts: ["ekl.test.com", "ekl1.test1.com"]
  
  
  discovery.zen.minimum_master_nodes: 1
  
  xpack.security.enabled: false
  
  
  searchguard.ssl.transport.pemcert_filepath: '/etc/elasticsearch/ssl/node2.pem'
  searchguard.ssl.transport.pemkey_filepath: 'ssl/node2.key'
  searchguard.ssl.transport.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
  searchguard.ssl.transport.enforce_hostname_verification: false
  searchguard.ssl.transport.resolve_hostname: false
  searchguard.ssl.http.enabled: true
  searchguard.ssl.http.pemcert_filepath: '/etc/elasticsearch/ssl/node2_http.pem'
  searchguard.ssl.http.pemkey_filepath: '/etc/elasticsearch/ssl/node2_http.key'
  searchguard.ssl.http.pemtrustedcas_filepath: '/etc/elasticsearch/ssl/root-ca.pem'
  searchguard.nodes_dn:
  - CN=ekl.test.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
  - CN=ekl1.test1.com,OU=Ops,O=BugBear BG\, Ltd.,DC=BugBear,DC=com
  searchguard.authcz.admin_dn:
  - CN=admin.test.com,OU=Ops,O=BugBear Com\, Inc.,DC=example,DC=com
  Certificates are self-signed
  </code></pre>
  
  <p>From node i can telnet to ports 9200/9300 by hostnames i can ping and </p>
  
  <p>curl -kvX GET "<a href="https://admin:pass@ekl.test.com:9200" rel="nofollow noreferrer">https://admin:pass@ekl.test.com:9200</a>" works fine.
  Errors on node:</p>
  
  <p>[ekl1.test1.com] not enough master nodes discovered during pinging (found [], but needed <a href="https://gryzli.info/2018/12/01/elasticsearchelk-stack-security-howto/" rel="nofollow noreferrer">1</a>), pinging again</p>
  
  <p>Both server names are correct</p>
  
  <p>I suspect issue is in self-signed certificate i imported it in trusted root CA anchor but error remained.</p>
  
  <p>If i specify IP instead of hostnames then getting:</p>
  
  <p>Illegal parameter in http or transport request found.
  This means that one node is trying to connect to another with
  a non-node certificate (no OID or searchguard.nodes_dn incorrect configured) or that someone
  is spoofing requests.</p>
  
  <blockquote>
    <p>ES Config path is /etc/elasticsearch
    [2019-03-28T21:25:56,450][INFO ][c.f.s.s.DefaultSearchGuardKeyStore] >[ekl1.test1.com] OpenSSL not available (this is not an error, we simply >fallback to built-in JDK SSL) because of java.lang.ClassNotFoundException: >io.netty.internal.tcnative.SSL</p>
  </blockquote>