From 3296ee0b1c079d2a4e97b18d182ffcbcb90467f3 Mon Sep 17 00:00:00 2001 From: Josh Mock Date: Fri, 30 Oct 2026 10:20:37 -0400 Subject: [PATCH] docs: drop verify: false from CA fingerprint example ca_fingerprint now pins the matching certificate as the only trust anchor and still validates chain, expiry and host name, so disabling verification is no longer needed. Document the pinning behavior and the explicit opt-out. Refs elastic/security#6842 Assisted-by: Pi Coding Agent (claude-opus-5-5) --- docs/reference/connecting.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/reference/connecting.md b/docs/reference/connecting.md index 27bd224a2e..282cd8b865 100644 --- a/docs/reference/connecting.md +++ b/docs/reference/connecting.md @@ -120,12 +120,13 @@ ELASTIC_PASSWORD = "" client = Elasticsearch::Client.new( host: "https://elastic:#{ELASTIC_PASSWORD}@localhost:9200", - transport_options: { ssl: { verify: false } }, ca_fingerprint: CERT_FINGERPRINT ) ``` -The verification will be run once per connection. +The certificate matching the fingerprint is used as the only trusted certificate. The server's certificate chain, expiration dates and host name are still validated against it, and this verification applies to every connection the client opens. + +If the host name you connect to doesn't match the server certificate's subject or subject alternative names, verification fails. Either connect using a host name listed in the certificate, or explicitly disable verification with `transport_options: { ssl: { verify: false } }`. Disabling verification weakens the security of the connection and isn't recommended. The certificate fingerprint can be calculated using `openssl x509` with the certificate file: