# Creating certs for kibana connecting to elastic

**URL:** <https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 8, 2020, 2:59am UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236 "2020-08-08T02:59:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AirJordan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/airjordan/32/46017_2.png) [@AirJordan](https://discuss.elastic.co/u/AirJordan)\
**Post date:** [August 8, 2020, 2:59am UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236/1 "2020-08-08T02:59:34Z")

</div>

So I am doing a demo of Elastic SIEM. Everything is working fine using http. Only a one server setup. Basic minimum, testing using PoC Domain. I do for the future want to know how to create certs using our domain using AD CS. Setting up Kibana for https using an AD CS server looks straight forward. I am having a harder time understanding setting elasticsearch to use a cert from AD CS and importing it into Kibana. Since it is only one node i am guessing I don't need to care about creating a node cert. We use Openfaas to create the csr and generate the pks file key file and .cry file. So I don't really need to rely on any csr generation on the elastic server. I figure I just need to know where to put the pem format for the key, cert and certificate authority. Then what user and permissions is needed. I am guessing they go under /etc/elasticsearch/certs? What permissions is needed? Then I need to run the command to add the .key password. Point the elastic.yml to the files. Then how do I add any files I need for kibana to talk to elastic on https? Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 9, 2020, 1:37pm UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236/2 "2020-08-09T13:37:57Z")

</div>

Sorry, it's not immediately clear to me what you're trying to do.

There are, realistically 3 sets of certificates that you might be asking about.

1. If you enabled `https` for Kibana, then there is a server certificate (and key) for Kibana that is used when browsers connect to Kibana.
2. If you enabled `https` for Elasticsearch, then there is a server certificate (and key) for Elasticsearch that is used when clients (including Kibana) connect to Elasticsearch
3. If you enabled `https` for Elasticsearch, and you enabled _client authentication_ then there is a client certificate (and key) for each client (including Kibana) that connects to Elasticsearch.

I believe you are saying that you have (1) under control, and are interested in (2). I don't think you are interested in (3).

For (2), there are instructions [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/configuring-tls.html#tls-http).  
You can skip step 1 of those instructions.

Place the `.crt` and `.key` files in somewhere within your configuration directory (probably `/etc/elasticsearch/certs`), make sure they are readable by the user that runs elasticsearch (probably `elasticsearch`) and configure `elasticsearch.yml` as follows:

```auto
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: /etc/elasticsearch/certs/es-http.key 
xpack.security.http.ssl.certificate: /etc/elasticsearch/certs/es-http.crt 

```

Then copy the signing chain (certificate authorities) somewhere that your Kibana user can read them, and then configure `elasticsearch.ssl.certificateAuthorities`

---

<div class="post-metadata">

**Author:** ![AirJordan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/airjordan/32/46017_2.png) [@AirJordan](https://discuss.elastic.co/u/AirJordan)\
**Post date:** [August 12, 2020, 4:13pm UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236/3 "2020-08-12T16:13:23Z")

</div>

Thanks very helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2020, 4:13pm UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236/4 "2020-09-09T16:13:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.