{"record":{"id":"a5473fb23f37a228","repo":"apache/seatunnel","slug":"tls-hostname-verification-disabled-not-recommend","errorCode":null,"errorMessage":"TLS hostname verification disabled - not recommended for production","messagePattern":"TLS hostname verification disabled - not recommended for production","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java","lineNumber":110,"sourceCode":"                                keystorePath, keystorePassword, truststorePath, truststorePassword);\n\n                if (sslContext.isPresent()) {\n                    httpClientBuilder.setSSLContext(sslContext.get());\n                    log.debug(\"Custom SSL context configured with keystore/truststore\");\n                } else {\n                    log.debug(\"No custom SSL context configured, using default\");\n                }\n            } else {\n                // Trust all certificates (not recommended for production)\n                SSLContext sslContext =\n                        SSLContexts.custom().loadTrustMaterial(new TrustAllStrategy()).build();\n                httpClientBuilder.setSSLContext(sslContext);\n                log.warn(\"TLS certificate verification disabled - not recommended for production\");\n            }\n\n            if (!tlsVerifyHostnames) {\n                httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);\n                log.warn(\"TLS hostname verification disabled - not recommended for production\");\n            }\n\n            log.debug(\n                    \"TLS configuration completed - certificate verification: {}, hostname verification: {}\",\n                    tlsVerifyCertificate,\n                    tlsVerifyHostnames);\n        } catch (Exception e) {\n            throw new RuntimeException(\"Failed to configure TLS settings\", e);\n        }\n    }\n}\n","sourceCodeStart":92,"sourceCodeEnd":122,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-elasticsearch/src/main/java/org/apache/seatunnel/connectors/seatunnel/elasticsearch/client/auth/AbstractAuthenticationProvider.java#L92-L122","documentation":"AbstractAuthenticationProvider.configureTLS sets a NoopHostnameVerifier when tls_verify_hostnames=false, meaning the certificate's hostname is not checked against the connection host. A warn is logged because this enables man-in-the-middle attacks; nothing fails.","triggerScenarios":"HTTPS Elasticsearch connection configured with tls_verify_hostnames=false, e.g. when the cert CN doesn't match the hostname used in the URL.","commonSituations":"Connecting via IP address or internal DNS alias while the certificate was issued for a different name; copy-pasted security-disabled configs from dev.","solutions":["Set tls_verify_hostnames=true","Use the hostname that matches the certificate's SAN/CN in the URL","Reissue or regenerate the certificate with the correct SAN entries"],"exampleFix":"// before\nurl = \"https://10.0.0.5:9200\"\ntls_verify_hostnames = false\n// after\nurl = \"https://es.internal.example.com:9200\"\ntls_verify_hostnames = true","handlingStrategy":"validation","validationCode":"// ensure hostname in URL matches certificate SAN\nopenssl x509 -in es.crt -noout -text | grep -A1 'Subject Alternative Name'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep tls_verify_hostnames=true","Use DNS names matching the certificate in URLs","Regenerate certs with correct SANs for IPs/aliases"],"tags":["tls","security","hostname-verification"],"backgroundTag":"tls-verification-disabled","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T21:17:11.552Z"}