Add new node in ES cluster

Elastic Stack Elasticsearch
1

Previously, I generated certificates for my ES nodes through the below command.

/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in /tmp/instance.yml --out /root/new/new_cert.zip

Now I want to add a new node by defining the previous CA certificate but it's not working.

/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /root/new/ca/ca.crt --name node-04 --dns node-04 --ip 172.16.0.1

Here is the error log.

Exception in thread "main" java.io.IOException: toDerInputStream rejects tag type 45
at java.base/sun.security.util.DerValue.toDerInputStream(DerValue.java:858)
at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1982)
at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222)
at java.base/java.security.KeyStore.load(KeyStore.java:1472)
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyStore(CertParsingUtils.java:76)
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readPkcs12KeyPairs(CertParsingUtils.java:135)
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.lambda$loadPkcs12CA$1(CertificateTool.java:341)
at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:932)
at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:85)
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.loadPkcs12CA(CertificateTool.java:340)
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.getCAInfo(CertificateTool.java:328)
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:684)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:77)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
at org.elasticsearch.cli.Command.main(Command.java:90)
at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:137)

2

See our documentation:

--ca : Specifies the path to an existing CA key pair (in PKCS#12 format). This parameter cannot be used with the ca or csr parameters.

You, on the other hand, are passing in a certificate in PEM format, and the tool is throwing an error.

You need to pass --ca-cert /root/new/ca/ca.crt --ca-key /root/new/ca/ca.key in the command above

3

ca.key file was not generated earlier that's why I'm having difficulties to sign a new node from an existing CA. There is only ca.crt file in ca folder.

4

Apologies, I misread your original command

/usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in /tmp/instance.yml --out /root/new/new_cert.zip

I guess you mean

/usr/share/elasticsearch/bin/elasticsearch-certutil cert --pem --in /tmp/instance.yml --out /root/new/new_cert.zip

as you can't pass both ca and cert in the same invocation.

Unfortunately when you run cert and you don't specify the CA yourself, the tool generates one on the fly for you and does not keep the CA key around, unless you tell it to do so with --keep-ca-key.
In essence, you have no way to create new certificates that are signed by the same CA as the one that has signed the existing nodes' certificates as you are missing the CA key. You would need to recreate a CA and use that to sign new certificates for all your nodes and the one for your new node.

5

Thank you for your guidance.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.