# Config SSL/TLS Kibana and Elasticsearch

**URL:** <https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, fleet\
**Created:** [November 18, 2020, 10:47am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820 "2020-11-18T10:47:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aloalo2242](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aloalo2242/32/78043_2.png) [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\
**Post date:** [November 18, 2020, 10:47am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820/1 "2020-11-18T10:47:34Z")

</div>

Hi,

Im trying to enable Fleet in Ingest Manager. And it say I have to enable this **xpack.security.authc.api\_key.enabled: true** in elasticsearch.yml. But if add that line, I have to add bellow line too:

```
 xpack.security.enabled: true
 xpack.security.authc.api_key.enabled: true
 xpack.security.http.ssl.enabled: true
 xpack.security.http.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
 xpack.security.http.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
 xpack.security.http.ssl.client_authentication: optional
 xpack.security.transport.ssl.enabled: true
 xpack.security.transport.ssl.verification_mode: certificate
 xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12

```

And this is my config in kibana.yml

```
  elasticsearch.hosts: ["https://localhost:9200"]
  xpack.ingestManager.enabled: true
  xpack.ingestManager.fleet.tlsCheckDisabled: true 
  #xpack.encryptedSavedObjects.encryptionKey: ""
  xpack.security.enabled: true
  elasticsearch.username: "elastic"
  elasticsearch.password: "mypassword"
  elasticsearch.ssl.verificationMode: certificate
  elasticsearch.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12

```

Both Kibana and Elasticsearch status after reboot is Active. I check elasticsearch log and got this response

```
 [2020-11-18T14:56:42,401][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [node-1] http client did not trust this server's certificate, closing connection Netty4HttpChannel{localAddress=/:9200, remoteAddress=/:63845}
 [2020-11-18T14:56:57,618][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [node-1] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/:9200, remoteAddress=:62987}

```

And I can't access Kibana web ☹

This site can’t be reached

refused to connect.

Please help me. Thanks!

---

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [November 18, 2020, 10:54am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820/2 "2020-11-18T10:54:06Z")

</div>

It looks like the trustore you're using has no or a different CA certificate than the one the signed the certificate of your Elasticsearch instances. Could you check that?

---

<div class="post-metadata">

**Author:** ![aloalo2242](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aloalo2242/32/78043_2.png) [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\
**Post date:** [November 18, 2020, 11:03am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820/3 "2020-11-18T11:03:25Z")

</div>

I generate the CA by use this cmd: _bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12_  
without create password for the CA. Then I move it to path as above.

---

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [November 18, 2020, 12:37pm UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820/4 "2020-11-18T12:37:14Z")

</div>

This looks like you just put the CA certificate where Kibana client certificate (more exact, the bundle including the client certificate and the CA certificate) should be.

This works just like other http TLS connections. So you need the CA to be known to the various clients and every client needs their own certificate, signed by the CA.

---

<div class="post-metadata">

**Author:** ![aloalo2242](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aloalo2242/32/78043_2.png) [@aloalo2242](https://discuss.elastic.co/u/aloalo2242)\
**Post date:** [November 20, 2020, 2:37am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820/5 "2020-11-20T02:37:23Z")

</div>

Thanks for your suggestions, I should use `bin/elasticsearch-certutil http` and put  
`elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/elasticsearch-ca.pem"]` in `kibana.yml`  
and  
`xpack.security.http.ssl.keystore.path: "http.p12"` in `elasticsearch.yml`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 18, 2020, 2:37am UTC](https://discuss.elastic.co/t/config-ssl-tls-kibana-and-elasticsearch/255820/6 "2020-12-18T02:37:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.