Skip to content

docs: drop verify: false from CA fingerprint example #3079

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
JoshMock wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

docs: drop verify: false from CA fingerprint example #3079

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions docs/reference/connecting.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,12 +120,13 @@

client = Elasticsearch::Client.new(
host: "https://elastic:#{ELASTIC_PASSWORD}@localhost:9200",
transport_options: { ssl: { verify: false } },
ca_fingerprint: CERT_FINGERPRINT
)
```

The verification will be run once per connection.
The certificate matching the fingerprint is used as the only trusted certificate. The server's certificate chain, expiration dates and host name are still validated against it, and this verification applies to every connection the client opens.

If the host name you connect to doesn't match the server certificate's subject or subject alternative names, verification fails. Either connect using a host name listed in the certificate, or explicitly disable verification with `transport_options: { ssl: { verify: false } }`. Disabling verification weakens the security of the connection and isn't recommended.

Check notice on line 129 in docs/reference/connecting.md

View workflow job for this annotation

GitHub Actions / build / vale 

Elastic.WordChoice: Consider using 'deactivate, deselect, hide, turn off' instead of 'disable', unless the term is in the UI.

The certificate fingerprint can be calculated using `openssl x509` with the certificate file:

Expand Down
Loading