# Converting self signed certificate to ones from 3rd party - Kibana server **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [December 2, 2020, 5:16pm UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396 "2020-12-02T17:16:35Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Waxman](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Post date:** [December 2, 2020, 5:16pm UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396/1 "2020-12-02T17:16:35Z")
Hello People, I'm using elk stack running on 7.9.2 version. Now I use self signed certificates, generated by certutil built-in elasticsearch (bin/elasticsearch-certutil cert) I have a few questions about certificates: 1. How can I convert existing ca.crt (self signed) for CSR request (3 rd party certificate and key) 2. Can I use self signed CA authority for Elastic Nodes and own certificate for Kibana server ? (I suppose yes) 3. Just confirm my thinking: when I have two hosts with kibana instances (two nodes of kibana) I may use one certificate for both when SAN specifies two different FQDN : kibana01.xxx.xx and kibna02.xxx.xx - then I can use some laodbalancer between them and use this certificate. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 3, 2020, 12:13am UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396/2 "2020-12-03T00:13:22Z")
> [@Waxman](#): > > How can I convert existing ca.crt (self signed) for CSR request (3 rd party certificate and key) In terms of actual certificates, you can't. There's no practical way to reissue a certificate with a different CA. You _can_ reuse the underlying key to generate a CSR (although not with `certutil`, you'd have to use `openssl`), but I don't think that would have any practical benefit. That other was to answer your question is _When I get new certificates how do I switch to them?_, which depends a little bit on your setup. Technically, it's just a matter of switching things in `elasticsearch.yml`, but if you have clients connecting, then they need to be prepared for the change, and if you are switching your internode (`transport.ssl`) certificates, then you either need a full restart, or a planned out migration path to upgrade using rolling restarts. > [@Waxman](#): > > Can I use self signed CA authority for Elastic Nodes and own certificate for Kibana server ? (I suppose yes) There's actually 3 set of certificates: 1. Certificates that the Elasticsearch nodes use to connect to each other (`xpack.security.transport.ssl` in `elasticsearch.yml`) 2. Certificates that the Elasticsearch nodes use for the REST API (`xpack.security.http.ssl` in `elasticsearch.yml`) 3. Certificates that Kibana uses for its UI & API (in `server.ssl` in `kibana.yml`) For (1) we strongly recommend that you use a dedicated CA specifically for that purpose. It provids the strongest protections about cluster membership. For (2) and (3) it can be helpful to use a third party CA (either a public CA or an internal corporate CA) so that you minimise the amount of trust config that your clients (web browsers and ES Rest clients) need. > [@Waxman](#): > > Just confirm my thinking: when I have two hosts with kibana instances (two nodes of kibana) I may use one certificate for both when SAN specifies two different FQDN : kibana01.xxx.xx and kibna02.xxx.xx - then I can use some laodbalancer between them and use this certificate. It depends on what sort of Load-Balancer you use If your load balancer operates at the http/s level (an _"Application Load Balancer"_ or _"Layer 7 Load Balancer"_ or _"Reverse Proxy"_) then it will terminate the TLS connection itself and as far as the browsers are concerned, it's the certificate installed into the Load Balancer that matters. You will need to decide what the TLS connection between the load balancer and Kibana will look like and for that, you can use a single cert with 2 DNS SANs, but there are other options, depending on what your load balancer supports. If your load balancer operates at the TCP/IP level (a _"Network Load Balancer"_ or _"Layer 4 Load Balancer"_) then it will just route packets to the Kibana servers directly, and each Kibana server will need to have a certificate with a SAN that matches the FQDN that your users use to connect (like `kibana.xxx.xx`) - as far as the web browsers are concerned there's only 1 server to talk to, so each Kibana needs to act like it's that server on that shared URL. ---
**Author:** ![Waxman](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Post date:** [December 3, 2020, 7:56am UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396/3 "2020-12-03T07:56:38Z")
Thanks a lot TimV ! You did great job. May I have few more questions? 1.Let's say I will use new cert fo Kibana and it's UI/API. Now i've got such configuration: ```auto server.ssl.certificate: /usr/share/kibana/config/certs/kibana01/kibana01.crt server.ssl.key: /usr/share/kibana/config/certs/kibana01/kibana01.key elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/certs/ca/ca.crt"] elasticsearch.ssl.verificationMode: certificate ``` So to do that I need replace kibana01/02.crt and kibana01/02.key with 3rd party certificate and key, right ? For CSR request I may use certutil with the option: ```auto bin/elasticsearch-certutil csr --silent --in config/certificates/instances.yml -out /certs/bundle_csr.zip ``` and in instaces.yml I will put my two kibana's instances: ```auto instances: - name: 'uelkkib01d.upc.pl' dns: - kibana01.xxx.xx - kibana02.xxx.xx ``` and finally I need receive right cert and key from the different CA. Is that correct ? This key and cert will be use via loadbalancer (KEMP) which will balance both kibanas on [https://kibana.xxx.xx](https://kibana.xxx.xx) 2. Can I replace certs and key's for all nodes when I will generate via certutil but on a different cluster. Let's say I have two clusters: A and B. I will use instances.yml from A to generate certs/keys for A but via B (hope its clear). Will these keys/certs generated on B are usable on A ? ---
**Author:** ![Waxman](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@Waxman](https://discuss.elastic.co/u/Waxman)\ **Post date:** [December 9, 2020, 3:35pm UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396/4 "2020-12-09T15:35:24Z")
> [@Waxman](#): > > 1.Let's say I will use new cert fo Kibana and it's UI/API. Now i've got such configuration: > > ```auto > server.ssl.certificate: /usr/share/kibana/config/certs/kibana01/kibana01.crt > server.ssl.key: /usr/share/kibana/config/certs/kibana01/kibana01.key > elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/certs/ca/ca.crt"] > elasticsearch.ssl.verificationMode: certificate > > ``` > > So to do that I need replace kibana01/02.crt and kibana01/02.key with 3rd party certificate and key, right ? > For CSR request I may use certutil with the option: > > ```auto > bin/elasticsearch-certutil csr --silent --in config/certificates/instances.yml -out /certs/bundle_csr.zip > > ``` > > and in instaces.yml I will put my two kibana's instances: > > ```auto > instances: > - name: 'uelkkib01d.upc.pl' > dns: > - kibana01.xxx.xx > - kibana02.xxx.xx > > ``` > > and finally I need receive right cert and key from the different CA. Is that correct ? Maybe the answer of the question will help someone else: ad1. We can use for kibana server ssl completely different certificates, they don't need to be generated via certutil (it might be openssl) > [@Waxman](#): > > 1. Can I replace certs and key's for all nodes when I will generate via certutil but on a different cluster. Let's say I have two clusters: A and B. I will use instances.yml from A to generate certs/keys for A but via B (hope its clear). Will these keys/certs generated on B are usable on A ? Ad 2. Acctually it's possible but probably not real, cause we need to use same names for cluster A & B (see instances.yml): > [@Waxman](#): > > ```auto > instances: > - name: 'uelkkib01d.upc.pl' > dns: > - kibana01.xxx.xx > - kibana02.xxx.xx > > ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 6, 2021, 3:35pm UTC](https://discuss.elastic.co/t/converting-self-signed-certificate-to-ones-from-3rd-party-kibana-server/257396/5 "2021-01-06T15:35:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.