# Cannot Enable Kibana for SSL
**URL:** https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980
**Category:** Kibana
**Created:** [March 25, 2017, 6:53am UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980 "2017-03-25T06:53:49Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@arianayay](https://discuss.elastic.co/u/arianayay)
#### Post date: [March 25, 2017, 6:53am UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/1 "2017-03-25T06:53:49Z")
Hi,
I am getting this error when accessing kibana though my elasticsearch is working fine.
I have configured my kibana.yml this way:
server.ssl.cert: D:\Elasticsearch 5.2.2\elasticsearch-5.2.2\config\x-pack\instancename.crt (same with elastic)
server.ssl.key: D:\Elasticsearch 5.2.2\elasticsearch-5.2.2\config\x-pack\instancename.key (same with elastic)
elasticsearch.ssl.ca: D:\Elasticsearch 5.2.2\kibana-5.2.2-windows-x86\plugins\x-pack\ca.pem (same with elastic)
elasticsearch.url: [https://instancename.com:9200](https://instancename.com:9200)
xpack.security.encryptionKey: "Elasticsearch123456789009876543211234567890"
xpack.security.sessionTimeout: 600000
xpack.security.secureCookies: true
xpack.security.cookieName: "sid"
---
### Author:  [@joshbressers](https://discuss.elastic.co/u/joshbressers)
#### Post date: [March 25, 2017, 2:33pm UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/2 "2017-03-25T14:33:57Z")
This behavior is correct actually. It looks like your Kibana instance is using https, but the certificate hasn't been signed by a Certificate Authority your browser trusts so it marks the page as untrusted. You have three options basically.
1. Live with this warning
2. Import the CA certificate generated by certgen into your browser
3. Get your Kibana certificate signed by a proper CA. You can read more about how to generate a certificate signing request here:
[https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html#generating-csr](https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html#generating-csr)
Good luck.
---
### Author:  [@arianayay](https://discuss.elastic.co/u/arianayay)
#### Post date: [March 25, 2017, 4:27pm UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/3 "2017-03-25T16:27:42Z")
Hi.
Upon checking, both ca.crt and server.crt/instancename.crt have been imported.
I'm not sure why Kibana is not reading this certificates. I have also tried importing the cert in Google Chrome by using this method:
> **[Install Client Digital Certificate - Win...](https://support.globalsign.com/customer/portal/articles/1211541-install-client-digital-certificate---windows-using-chrome)**
>
> Installing Your PKCS#12 Client Digital Certificate File in Windows Using Chrome
>
> Article Purpose: This article provides ...
Please advise! Thanks!
---
### Author:  [@joshbressers](https://discuss.elastic.co/u/joshbressers)
#### Post date: [March 25, 2017, 7:12pm UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/4 "2017-03-25T19:12:04Z")
I tested this on my end to ensure things worked as expected. I did run into an issue by double clicking the CA certificate to install it rather than using the import feature from the "Manage Certificates" option in Chrome. The former wouldn't work, the latter did.
Also make sure the certificate is in the "Trusted Root Certification Authorities" tab when you view the Certificates manager.
You should also verify the Kibana certificate has the correct hostname.
---
### Author:  [@arianayay](https://discuss.elastic.co/u/arianayay)
#### Post date: [March 26, 2017, 4:57pm UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/5 "2017-03-26T16:57:07Z")
Hi,
May you clarify this part of the document?
Is the server.key and server.crt the same with the node01.key and node01.crt generated in Certgen? Or we need to generate another .key and .crt which Kibana will connect to? Also, what is the **subjectAltName** the document is referring to? As per checking, if I create another certificate for Kibana they should have the same IP and FQDN since Elasticsearch and Kibana are configured on the same server.
Please advise! Thanks.
---
### Author:  [@joshbressers](https://discuss.elastic.co/u/joshbressers)
#### Post date: [March 26, 2017, 8:16pm UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/6 "2017-03-26T20:16:02Z")
If you used certgen the subjectAltName should be oK (its' just where the DNS and IP address information is held). For example:
$ openssl x509 -in kibana.crt -text | grep -A 1 Alternative
X509v3 Subject Alternative Name:
DNS:localhost, IP Address:127.0.0.1
You should very the DNS and IP Address in the certificate are correct using the above command.
As for sharing the same certificate between various services. It's easier from a management perspective. There are some very esoteric reasons not to do this, but in reality the risk is minimal. If you want to share the certificate you probably won't have any problems.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [March 27, 2017, 12:25am UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/7 "2017-03-27T00:25:17Z")
> [@arianayay](#):
>
> I am getting this error when accessing kibana though my elasticsearch is working fine.
You're access Kibana via `localhost`.
Unless you generated the certificate for "localhost" then that's likely to be the cause of your problem.
The hostname you enter into your browser has to match the hostname that you used when generating the certificate.
If that doesn't solve the problem, then you will need to investigate _why_ your browser is rejecting the certificate. In chrome, you need to use the developer tools and look at the security tab. That will tell you what Chrome thinks is wrong with your certificate - otherwise we're just guessing.
---
### Author:  [@arianayay](https://discuss.elastic.co/u/arianayay)
#### Post date: [March 28, 2017, 2:18am UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/8 "2017-03-28T02:18:35Z")
Hi All,
As per checking, certificate is valid but there is connection issues.
Do we need to configure something for this? Thanks!
---
### Author:  [@arianayay](https://discuss.elastic.co/u/arianayay)
#### Post date: [March 28, 2017, 2:26am UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/9 "2017-03-28T02:26:03Z")
Also, same issue occurs even if I point the URL to the hostname's DNS. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2017, 2:26am UTC](https://discuss.elastic.co/t/cannot-enable-kibana-for-ssl/79980/10 "2017-04-25T02:26:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.