Datanode Upgrade Issue 7.0.5 to 7.1.3

Hi All,
Upgraded following this
Upgrade Graylog on Ubuntu

Graylog servers work fine, but on the datanode first one i now get the following.

It’s like during the upgrade the certificates have been overwritten or movd/deleted?
Any ideas please?
I now have a very poorly system!

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl] [2026-06-12T13:18:45,370][WARN ][i.n.c.AbstractChannelHandlerContext] [192.168.209.32] An exception 'OpenSearchSecurityException[The provided TCP channel is invalid.]; nested: DecoderException[javax.net.ssl.SSLHandshakeException: (certificate_unknown) No subject alternative DNS name matching pedro-grdn-03.home.lab found.]; nested: SSLHandshakeException[(certificate_unknown) No subject alternative DNS name matching pedro-grdn-03.home.lab found.]; nested: CertificateException[No subject alternative DNS name matching pedro-grdn-03.home.lab found.];' [enable DEBUG level for full stacktrace] was thrown by a user handler's exceptionCaught() method while handling the following exception:

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl] io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: (certificate_unknown) No subject alternative DNS name matching pedro-grdn-03.home.lab found.

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:515)

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:296)

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)

2026-06-12T13:18:45.390Z INFO  [OpensearchProcessImpl]  at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:171)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:796)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:697)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:660)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562)

2026-06-12T13:18:45.391Z INFO  [OpensearchProcessImpl]  at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/java.lang.Thread.run(Thread.java:1583)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl] Caused by: javax.net.ssl.SSLHandshakeException: (certificate_unknown) No subject alternative DNS name matching pedro-grdn-03.home.lab found.

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:130)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1287)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1164)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1107)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:393)

2026-06-12T13:18:45.392Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:477)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1273)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1260)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at java.base/java.security.AccessController.doPrivileged(AccessController.java:714)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1205)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1695)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1541)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1377)

2026-06-12T13:18:45.393Z INFO  [OpensearchProcessImpl]  at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1428)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:545)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:484)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  ... 16 more

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl] Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching pedro-grdn-03.home.lab found.

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:207)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:103)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:466)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:417)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:291)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)

2026-06-12T13:18:45.394Z INFO  [OpensearchProcessImpl]  at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1265)

Hi @psfletchthetek

The critical line is:

So what happened there? Why is pedro-grdn-03.home.lab not being found?

So the upgrade is on pedro-grdn-02.home.lab,
And there are identical alerts as per above from 02, about pedro-grdn-01.home.lab & pedro-grdn-03.home.lab. Stating No subject alternative DNS name matching pedro-grdn-03.home.lab found.

But before the upgrade, it did and was working!

Can you tell me more about your environment? Where are your datanodes running? Any virtualized environment or containers?

Has the networking changed anyhow?

It seems that your certificates are now not matching DNS names of your servers. Opensearch is connecting to pedro-grdn-03.home.lab, but the certificate returned is not containing this name in SAN.

Do you have any node_name or hostname configured for your nodes?