# Elasticsearch can't login https://localhost:9200 after setting ssl **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [April 15, 2021, 2:49am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169 "2021-04-15T02:49:55Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![gricn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gricn/32/87079_2.png) [@gricn](https://discuss.elastic.co/u/gricn)\ **Post date:** [April 15, 2021, 2:49am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/1 "2021-04-15T02:49:55Z")
Environment: Win10 WLS2 Ubuntu 20.04, Docker version 20.10.5, Docker-compose version 1.29.0, ELK 7.12.0, nginx version 1.18.0 I have enabled `xpack` in the last version `docker-compose.yml` setting and use `./bin/elasticsearch-setup-passwords auto` to create accounts and passwords. Login with `elastic` username and its corresponding password both elasticsearch（[http://localhost:9200](http://localhost:9200)） and kibana([http://localhost:5601](http://localhost:5601)) works fine. The parameter and its value in `.env` file is correct and the `docker-compose.yml` file is as below. ```auto version: '2.2' services: elasticsearch: image: elasticsearch:7.12.0 privileged: true user: root command: - /bin/bash - -c - sysctl -w vm.max_map_count=262144 && su elasticsearch -c bin/elasticsearch container_name: elasticsearch environment: - discovery.type=single-node - bootstrap.memory_lock=true - xpack.security.enabled=true - "ES_JAVA_OPTS=-Xms512m -Xmx512m -Dhttp.proxyHost=172.23.176.1 -Dhttp.proxyPort=7890 -Dhttps.proxyHost=172.23.176.1 -Dhttps.proxyPort=7890" ulimits: memlock: soft: -1 hard: -1 volumes: - esdata1:/usr/share/elasticsearch/data - ./analysis-ik/IKAnalyzer.cfg.xml:/usr/share/elasticsearch/config/analysis-ik/IKAnalyzer.cfg.xml ports: - 9200:9200 networks: - elastic kibana: image: kibana:7.12.0 container_name: kibana depends_on: - elasticsearch environment: - xpack.security.enabled=true - ELASTICSEARCH_URL=http://elasticsearch:9200 - ELASTICSEARCH_USERNAME=kibana_system - ELASTICSEARCH_PASSWORD=$KIBANA_SYSTEM_PASSWORD ports: - 5601:5601 networks: - elastic volumes: esdata1: driver: local networks: elastic: driver: bridge ``` To secure the connection, I try to config ssl. I generate `.crt` and `.key` files for ca, elasticsearch, kibana with the code below. ```auto openssl req -newkey rsa:4096 \ -x509 \ -sha256 \ -days 3650 \ -nodes \ -out elasticsearch.crt \ -keyout elasticsearch.key \ -subj "/C=CN/ST=Beijing/L=Beijing/O=XXXX/OU=XXXX" ``` I follow the official doc's guideline to config `docker-compose.yml` , but the new version file not work. I have checked that all the `.key` and `.crt` file are place in the correct location, I have not add these file to nginx. I can open `https://localhost:9200` , but after typing the username `elastic` and its password, the webpage refresh and is stilled on the original page. [![elasticsearch page](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed53880300ed3a3ce7d28179c60f6069f482b4ca.jpeg)](https://i.stack.imgur.com/Bx1KY.jpg) As for the Browser's Console of `https://localhost:9200`, it says `Failed to load resource: the server responded with a status of 401 ()` New `docker-compose.yml` is as below. ```auto version: "2.2" services: elasticsearch: image: elasticsearch:${VERSION} container_name: elasticsearch environment: - discovery.type=single-node - bootstrap.memory_lock=true - "ES_JAVA_OPTS=-Xms512m -Xmx512m" - xpack.license.self_generated.type=basic - xpack.security.enabled=true - xpack.security.http.ssl.enabled=true - xpack.security.http.ssl.key=$CERTS_DIR/elasticsearch/elasticsearch.key - xpack.security.http.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt - xpack.security.http.ssl.certificate=$CERTS_DIR/elasticsearch/elasticsearch.crt - xpack.security.transport.ssl.enabled=true - xpack.security.transport.ssl.verification_mode=certificate - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt - xpack.security.transport.ssl.certificate=$CERTS_DIR/elasticsearch/elasticsearch.crt - xpack.security.transport.ssl.key=$CERTS_DIR/elasticsearch/elasticsearch.key ulimits: memlock: soft: -1 hard: -1 volumes: - data01:/usr/share/elasticsearch/data - ./analysis-ik/IKAnalyzer.cfg.xml:/usr/share/elasticsearch/config/analysis-ik/IKAnalyzer.cfg.xml # - ./elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml - certs:$CERTS_DIR ports: - 9200:9200 - 9300:9300 networks: - elastic mem_limit: 2g # Delete when deploy in the server healthcheck: test: curl --cacert $CERTS_DIR/ca/ca.crt -s https://localhost:9200 >/dev/null; if [[$? == 52]]; then echo 0; else echo 1; fi interval: 30s timeout: 10s retries: 5 kibana: image: kibana:${VERSION} container_name: kibana depends_on: {elasticsearch} depends_on: {"elasticsearch": {"condition": "service_healthy"}} ports: - 5601:5601 environment: SERVERNAME: localhost ELASTICSEARCH_URL: https://elasticsearch:9200 ELASTICSEARCH_HOSTS: https://elasticsearch:9200 ELASTICSEARCH_USERNAME: kibana_system ELASTICSEARCH_PASSWORD: ${KIBANA_SYSTEM_PASSWORD} ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES: $CERTS_DIR/ca/ca.crt SERVER_SSL_ENABLED: "true" SERVER_SSL_KEY: $CERTS_DIR/kibana/kibana.key SERVER_SSL_CERTIFICATE: $CERTS_DIR/kibana/kibana.crt volumes: - certs:$CERTS_DIR networks: - elastic volumes: data01: driver: local certs: driver: local networks: elastic: driver: bridge ``` Both the code below are not OK. ```auto $ docker run --rm -v es_certs:/certs --network=es_elastic elasticsearch:7.12.0 curl --cacert /certs/ca/ca.crt -u elastic:PASSWORD https://elasticsearch:9200 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 curl: (60) SSL certificate problem: self signed certificate More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. ``` ```auto $ docker run --rm -v es_certs:/certs --network=es_elastic elasticsearch:7.12.0 curl --insecure --cacert /certs/ca/ca.crt -u elastic:PASSWORD https://elasticsearch:9200 % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 465 100 465 0 0 5109 0 --:--:-- --:--:-- --:--:-- 5109 {"error":{"root_cause":[{"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"unable to authenticate user [elastic] for REST request [/]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401} ``` How to fix it? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 15, 2021, 3:12am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/2 "2021-04-15T03:12:38Z")
Welcome to our community! 😃 That popup looks like nginx, not the Elastic Stack. What are you using nginx for? ---
**Author:** ![gricn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gricn/32/87079_2.png) [@gricn](https://discuss.elastic.co/u/gricn)\ **Post date:** [April 15, 2021, 3:20am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/3 "2021-04-15T03:20:19Z")
Thanks for your quick reply. I want to build up a search engine and need an index page, so I use nginx for ssl security including redirect http 80 port to https 443 port. So your opinion is that my nginx setting is not correct. Could you give any clues so I can google and try to fix the bug? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 15, 2021, 3:24am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/4 "2021-04-15T03:24:27Z")
I would start by removing nginx and then seeing if it goes away. ---
**Author:** ![gricn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gricn/32/87079_2.png) [@gricn](https://discuss.elastic.co/u/gricn)\ **Post date:** [April 15, 2021, 3:48am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/5 "2021-04-15T03:48:10Z")
I stopped nginx, but it is still `Failed to load resource: the server responded with a status of 401 ()` failure in console. I think it is not the nginx problem because I have not listen to port 9200 . Is there any way to reset elk password for docker users? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 15, 2021, 3:52am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/6 "2021-04-15T03:52:11Z")
> [@gricn](#): > > `Failed to load resource: the server responded with a status of 401 ()` failure in console What console? > [@gricn](#): > > I think it is not the nginx problem because I have not listen to port 9200 . I am not sure what that means sorry. > [@gricn](#): > > Is there any way to reset elk password for docker users? Docker doesn't have Elasticsearch users, so I am not sure what you mean there either sorry. ---
**Author:** ![gricn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gricn/32/87079_2.png) [@gricn](https://discuss.elastic.co/u/gricn)\ **Post date:** [April 15, 2021, 5:08am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/7 "2021-04-15T05:08:27Z")
Sorry, I did not describe the problem carefully. > This is the console pic ![Snipaste_2021-04-15_11-53-54](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d86695abc4a5b8814caaa2c66e55e93b54e4597.jpeg) > I think it is not the nginx problem because I have not listen to port 9200 . I use the nginx default setting, it only listen to port 80. So I think it has no relationship with 9200. > Docker doesn't have Elasticsearch users, so I am not sure what you mean there either sorry. > I run ELK I have use docker elasticseach image, I use `docker exec` into container and set password. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 15, 2021, 5:30am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/8 "2021-04-15T05:30:16Z")
Again, I would suggest you totally remove nginx from this and make sure auth to Elasticsearch works fine. ---
**Author:** ![gricn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gricn/32/87079_2.png) [@gricn](https://discuss.elastic.co/u/gricn)\ **Post date:** [April 15, 2021, 5:42am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/9 "2021-04-15T05:42:46Z")
while using docker, it only need to remove the nginx container. And I have tried to remove it, it is still not work, the same problem. ---
**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Post date:** [April 15, 2021, 6:40am UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/10 "2021-04-15T06:40:42Z")
In case it help... Here is how I'm setting that with docker compose ( `docker-compose.yml`): ```auto --- version: '3' services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:$ELASTIC_VERSION environment: - bootstrap.memory_lock=true - discovery.type=single-node - ELASTIC_PASSWORD=$ELASTIC_PASSWORD - xpack.security.enabled=$ELASTIC_SECURITY ulimits: memlock: soft: -1 hard: -1 ports: - 9200:9200 networks: ['stack'] kibana: image: docker.elastic.co/kibana/kibana:$ELASTIC_VERSION environment: - ELASTICSEARCH_USERNAME=elastic - ELASTICSEARCH_PASSWORD=$ELASTIC_PASSWORD ports: ['5601:5601'] networks: ['stack'] links: ['elasticsearch'] depends_on: ['elasticsearch'] networks: stack: {} ``` `.env` file is: ```auto ELASTIC_VERSION=7.12.0 ELASTIC_SECURITY=true ELASTIC_PASSWORD=changeme ``` ---
**Author:** ![gricn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gricn/32/87079_2.png) [@gricn](https://discuss.elastic.co/u/gricn)\ **Post date:** [April 15, 2021, 2:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/11 "2021-04-15T14:50:25Z")
Thanks for reply. My first `docker-compose.yml` file is as yours. Yes, it works well. The picture below is what I captured after docker-compose my first `docker-compose.yml`. ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/9/3984546f6268c5d82e4e3488dc78424ebfdb4c7d.png) **However, I wanted to run the project in production mode, so I had to consider its security.** So I config a new `docker-compose.yml` file (my second config file). It doesn't work. As for my `.env` file, it is OK. ```auto VERSION=7.12.0 ELASTICSEARCH_PASSWORD=changeme KIBANA_SYSTEM_PASSWORD=changeme COMPOSE_PROJECT_NAME=es CERTS_DIR=/usr/share/elasticsearch/config/certificates ``` So is there any clues about solving this problem? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 13, 2021, 2:50pm UTC](https://discuss.elastic.co/t/elasticsearch-cant-login-https-localhost-9200-after-setting-ssl/270169/12 "2021-05-13T14:50:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.