# Elastic-search SSL certification error, unable to open kibana **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [August 8, 2019, 12:08am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340 "2019-08-08T00:08:55Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![asad\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asad_ali/32/47894_2.png) [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Post date:** [August 8, 2019, 12:08am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/1 "2019-08-08T00:08:55Z")
I'm unable to open **kibana** as **elastic-search** is irresponsive as I made changes to elasticsearch.yml for SSL authentication. On dashboard on webpage i get "Cannot connect to the Elasticsearch cluster". **My elasticsearch.yml looks like** > xpack.security.http.ssl.enabled: true > xpack.security.transport.ssl.enabled: true > xpack.security.enabled: true > xpack.ssl.verification\_mode: none > xpack.security.transport.ssl.verification\_mode: certificate > xpack.security.http.ssl.verification\_mode: certificate > xpack.security.http.ssl.key: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.key > xpack.security.http.ssl.certificate: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.crt > xpack.security.http.ssl.certificate\_authorities: ["/usr/share/ca-certificates/mozilla/DigiCert\_Trusted\_Root\_G4.crt"] > xpack.security.transport.ssl.key: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.key > xpack.security.transport.ssl.certificate: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.crt > xpack.security.transport.ssl.certificate\_authorities: ["/usr/share/ca-certificates/mozilla/DigiCert\_Trusted\_Root\_G4.crt"] **error i get is also** > curl failed to verify the legitimacy of the server and therefore could not > establish a secure connection to it. To learn more about this situation and > how to fix it, please visit the web page mentioned above. > labuser@illumni8:/root/elasticsearch-7.1.1/config$ curl -v '[https://10.27.0.4:9200](https://10.27.0.4:9200)' > > - Expire in 0 ms for 6 (transfer 0x55e27d9cf5c0) > - Trying 10.27.0.4... > - TCP\_NODELAY set > - Expire in 200 ms for 4 (transfer 0x55e27d9cf5c0) > - Connected to 10.27.0.4 (10.27.0.4) port 9200 (#0) > - ALPN, offering h2 > - ALPN, offering http/1.1 > - successfully set certificate verify locations: > - CAfile: none > CApath: /etc/ssl/certs > - TLSv1.3 (OUT), TLS handshake, Client hello (1): > - TLSv1.3 (IN), TLS handshake, Server hello (2): > - TLSv1.2 (IN), TLS handshake, Certificate (11): > - TLSv1.2 (OUT), TLS alert, unknown CA (560): > - SSL certificate problem: unable to get local issuer certificate > - Closing connection 0 > curl: (60) SSL certificate problem: unable to get local issuer certificate > More details here: [curl - SSL CA Certificates](https://curl.haxx.se/docs/sslcerts.html) > > curl failed to verify the legitimacy of the server and therefore could not > establish a secure connection to it. To learn more about this situation and > how to fix it, please visit the web page mentioned above. **On elasticsearch logs , I get** ``` [2019-08-07T23:02:29,687][WARN][o.e.h.AbstractHttpServerTransport] [illumni8] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=0.0.0.0/0.0.0.0:9200, remoteAddress=/10.27.0.4:42440} [2019-08-07T23:02:28,702][WARN][o.e.h.AbstractHttpServerTransport] [illumni8] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=0.0.0.0/0.0.0.0:9200, remoteAddress=/127.0.0.1:41492} io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 48454144202f20485454502f312e310d0a417574686f72697a6174696f6e3a2042617369632064584e6c636a707759584e7a643239795a413d3d0d0a486f73743a203132372e302e302e313a393230300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a ``` Thank-you. ---
**Author:** ![harryk1](https://avatars.discourse-cdn.com/v4/letter/h/aeb1de/32.png) [@harryk1](https://discuss.elastic.co/u/harryk1)\ **Post date:** [August 8, 2019, 8:05pm UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/2 "2019-08-08T20:05:19Z")
Hi Asad, I am following this thread from your last post "Unable to configure 'x-pack security' under basic license. I am working on a similar setup in Kubernetes elastic(3-node) v7.1.0 and kibana. I am in the early state of setup, going through the parameters for elasticsearch.yml. I don't see the license parameter in your file, are you still doing it with basic license. xpack.license.self\_generated.type: "basic" Another thing, I am getting some weird errors while generating certs on k8s hosts. Did you face any issues there? Thanks, Harry ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [August 9, 2019, 7:07am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/3 "2019-08-09T07:07:03Z")
You show us how you have configured Elasticsearch, but now if and how you have configured kibana to connect to Elasticsearch now that the http layer is configured for TLS. Please see [Setting up TLS on a cluster | Elasticsearch Guide [7.3] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/7.3/ssl-tls.html) and step 2 in [Encrypting communications in Kibana | Kibana Guide [7.3] | Elastic](https://www.elastic.co/guide/en/kibana/7.3/configuring-tls.html) Can you share your kibana.yml ? > [@asad\_ali](#): > > **On elasticsearch logs , I get** > > ```auto > [2019-08-07T23:02:29,687][WARN][o.e.h.AbstractHttpServerTransport] [illumni8] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=0.0.0.0/0.0.0.0:9200, remoteAddress=/10.27.0.4:42440} > > [2019-08-07T23:02:28,702][WARN][o.e.h.AbstractHttpServerTransport] [illumni8] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=0.0.0.0/0.0.0.0:9200, remoteAddress=/127.0.0.1:41492} > io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 48454144202f20485454502f312e310d0a417574686f72697a6174696f6e3a2042617369632064584e6c636a707759584e7a643239795a413d3d0d0a486f73743a203132372e302e302e313a393230300d0a436f6e74656e742d4c656e6774683a20300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a > > ``` This is just a client ( could be Kibana or a browser request ) attempting to connect to Elasticsearch over http when Elasticsearch is already configured to expect connections with http over TLS ---
**Author:** ![asad\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asad_ali/32/47894_2.png) [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Post date:** [August 9, 2019, 7:41am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/4 "2019-08-09T07:41:07Z")
Thanks I finally solved with this .yml on both sides. but I'm not password prompt , its is said its not available under "basic **license**"? ``` xpack.security.http.ssl.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.enabled: false #xpack.ssl.verification_mode: none #xpack.security.transport.ssl.verification_mode: certificate #xpack.security.http.ssl.verification_mode: certificate xpack.security.http.ssl.key: cert/key.pem xpack.security.http.ssl.certificate: cert/star_inboxbiz_com.pem ``` and **kibanna.yml** ``` server.ssl.enabled: true server.ssl.key: /root/elasticsearch-7.1.1/config/cert/wildcard_inboxbiz_com.key server.ssl.certificate: /root/elasticsearch-7.1.1/config/cert/wildcard_inboxbiz_com.crt ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [August 9, 2019, 7:51am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/5 "2019-08-09T07:51:21Z")
> [@asad\_ali](#): > > Thanks I finally solved with this .yml on both sides Looks like you didn't solve that problem, instead you just disabled security in Elasticsearch with ```auto xpack.security.enabled: false ``` The changes you made to Kibana also, have nothing to do with the communication between Kibana and Elasticsearch but with the communication between your browser and Kibana. I would urge you to go through and read the available documetation ( [Setting up TLS on a cluster | Elasticsearch Guide [7.3] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/7.3/ssl-tls.html)) _in detail_ before moving forward with the rest of the configuration. It is a small upfront time investment that will pay off significantly when you actually try and configure this when knowing what needs to be configured and how ! We'll be happy to help with specific issues then 🙂 ---
**Author:** ![asad\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asad_ali/32/47894_2.png) [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Post date:** [August 9, 2019, 7:55am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/6 "2019-08-09T07:55:46Z")
> [@ikakavas](#): > > I would urge you to go through and read the available documetation ( [Setting up TLS on a cluster | Elasticsearch Guide [7.3] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/7.3/ssl-tls.html)) _in detail_ before moving forward with the rest of the configuration. It is a small upfront time investment that will pay off significantly when you actually try and configure this when knowing what needs to be configured and how ! We'll be happy to help with specific issues then 🙂 For 1 week whole spend long nights troubleshooting , it nothing seems to work. My mistake on ```auto xpack.security.enabled: false ``` i change back the settings, now i get same error as before. ---
**Author:** ![antcas](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@antcas](https://discuss.elastic.co/u/antcas)\ **Post date:** [August 9, 2019, 10:06am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/8 "2019-08-09T10:06:41Z")
I'm not sure if this helps, but we had some problems around ES+Kibana setup after enabling authentication. At first we enabled an anonymous user on ES, with superuser role, and everything went fine. Then we changed the role of the anonymous user and Kibana started to have problems. It was because we didn't add the ES username+password to the kibana config file and that's needed from Kibana to perform some operations on startup. AFter that, everything works fine. edit: ahhh, your problems seems to be around connection issues and not auth issues. Then probably my answer is not helpful at all at the moment ---
**Author:** ![asad\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asad_ali/32/47894_2.png) [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Post date:** [August 9, 2019, 10:06am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/9 "2019-08-09T10:06:54Z")
> [@ikakavas](#): > > ually try and configure this when knowing what needs to be configured and how ! We'll be happy to help with specific issues then On further looking at logs `[2019-08-09T10:00:22,692][WARN][o.e.h.AbstractHttpServerTransport] [node-1] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=0.0.0.0/0.0.0.0:9200, remoteAddress=/172.27.0.5:65296}` This remote address is uknown to me, where is remoteaddress info picked on? ---
**Author:** ![asad\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asad_ali/32/47894_2.png) [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Post date:** [August 9, 2019, 8:42pm UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/10 "2019-08-09T20:42:49Z")
Thanks, my recent error are **host-name** related. > network.host: 10.27.0.4 > network.publish\_host: 10.27.0.4 > #http.publish\_host: illumin8 > #http.host: illumin8 > transport.publish\_port: 9200 > > xpack.security.enabled: true > #xpack.security.http.ssl.enabled: true > xpack.security.transport.ssl.enabled: true > #xpack.security.enabled: false > #xpack.ssl.verification\_mode: none > #xpack.security.http.ssl.verification\_mode: certificate > > #xpack.security.http.ssl.key: cert/wildcard\_inboxbiz\_com.key > #xpack.security.http.ssl.certificate: cert/wildcard\_inboxbiz\_com.crt > #xpack.security.http.ssl.certificate\_authorities: ["cert/DigiCertCA2.pem"] > #xpack.security.http.ssl.certificate\_authorities: cert/DigiCertCA.crt > > xpack.security.transport.ssl.verification\_mode: certificate > xpack.security.transport.ssl.key: cert/wildcard\_inboxbiz\_com.key > xpack.security.transport.ssl.certificate: cert/wildcard\_inboxbiz\_com.crt > xpack.security.transport.ssl.certificate\_authorities: ["cert/DigiCertCA2.pem"] > > # xpack.security.transport.ssl.certificate\_authorities: cert/DigiCertCA.crt > elasticsearch.hosts: ["[https://10.27.0.4:9200](https://10.27.0.4:9200)"] > > elasticsearch.username: "elastic" > elasticsearch.password: "elk#123" > #elasticsearch.ssl.certificateAuthorities: ["/root/elasticsearch-7.1.1/config/cert/DigiCertCA.crt"] > > # Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively. > > # These settings enable SSL for outgoing requests from the Kibana server to the browser. > > server.ssl.enabled: true > server.ssl.key: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.key > server.ssl.certificate: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.crt > #lasticsearch.ssl.certificateAuthorities: ["/root/elasticsearch-7.1.1/config/cert/DigiCertCA2.pem"] > > #server.ssl.keyPassphrase: 12345 > > # Optional settings that provide the paths to the PEM-format SSL certificate and key files. > > # These files validate that your Elasticsearch backend uses the same key files. > > elasticsearch.ssl.certificate: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.crt > elasticsearch.ssl.key: /root/elasticsearch-7.1.1/config/cert/wildcard\_inboxbiz\_com.key > > # Optional setting that enables you to specify a path to the PEM file for the certificate > > # authority for your Elasticsearch instance. > > #elasticsearch.ssl.certificateAuthorities: ["/root/elasticsearch-7.1.1/config/cert/DigiCertCA2.pem"] > > # To disregard the validity of SSL certificates, change this setting's value to 'none'. > > elasticsearch.ssl.verificationMode: certificate ---
**Author:** ![asad\_ali](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/asad_ali/32/47894_2.png) [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Post date:** [August 10, 2019, 11:03am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/11 "2019-08-10T11:03:36Z")
Problem solved with **elasticsearch.hosts: ["[http://10.27.0.4:9200](http://10.27.0.4:9200)"]** was **https** , i got confused as most examples [https://www.elastic.co/guide/en/kibana/current/configuring-tls.html](https://www.elastic.co/guide/en/kibana/current/configuring-tls.html) it mentioned **https** which was misleading since i m using all in one ELK is one single host. Also, I'm not aware of any config on elasticsearch side to have it receive traffic as "https"? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 7, 2019, 11:03am UTC](https://discuss.elastic.co/t/elastic-search-ssl-certification-error-unable-to-open-kibana/194340/12 "2019-09-07T11:03:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.