Elasticsearch HTTPS and Adding to Java Rest Client

GoldNotepad · August 23, 2024, 9:14pm

I'm attempting to enable HTTPS for elasticsearch.

First I create the elasticsearch certificate authority.

elasticsearch-certutil ca

Then I generate the certificate.

elasticsearch-certutil cert --ca elastic-stack-ca.p12

This generates elastic-certificates.p12.

I have the configuration in my /usr/share/elasticsearch/config/elasticsearch.yml

xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.type: PKCS12
xpack.security.http.ssl.keystore.path: elastic-certificate.p12

For my RestClient I have:

RestClientBuilder clientBuilder = RestClient.builder(
  new HttpHost(host, port, "https"))
  .setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder
    .setSSLContext(sslContext)
    .setDefaultCredentialsProvider(credentialsProvider));

Adding the following code to allow the truststore doesn't seem to work.

String trustStoreFileName = "elastic-certificates.p12";
char[] trustStorePassword = null;
SSLContext sslContext;

ClassLoader classLoader = <FileName.java>.class.getClassLoader();
try (InputStream inputStream = classLoader.getResourceAsStream(trustStoreFilename)) {
  if (inputStream == null) {
    throw <ERROR>
  }
  KeyStore trustStore = Keystore.getInstance("PKCS12");
  trustStore.load(inputStream, trustStorePassword);
  sslContext = SSLContextBuilder.create().loadTrustMaterial(trustStore, null).build();
} catch (Exception e) { ... }

I'm not super familiar with how SSL works in this case. Does this seem right? Making requests explicitly ignoring the certificate seems to work but that is not what I want.

Any help would be appreciated.

dadoonet · August 26, 2024, 12:07pm

Welcome!

May be this could help?

github.com

testcontainers/testcontainers-java/blob/main/modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/ElasticsearchContainer.java#L172


      
                  // can happen if Elasticsearch is repackaged, i.e. with custom plugins
                  log.warn("CA cert under " + certPath + " not found.");
              }
              return Optional.empty();
          }
          
          /**
           * A SSL context based on the self-signed CA, so that using this SSL Context allows to connect to the Elasticsearch service
           * @return a customized SSL Context
           */
          public SSLContext createSslContextFromCa() {
              try {
                  CertificateFactory factory = CertificateFactory.getInstance("X.509");
                  Certificate trustedCa = factory.generateCertificate(
                      new ByteArrayInputStream(
                          caCertAsBytes()
                              .orElseThrow(() -> new IllegalStateException("CA cert under " + certPath + " not found."))
                      )
                  );
                  KeyStore trustStore = KeyStore.getInstance("pkcs12");
                  trustStore.load(null, null);

Topic		Replies	Views
Several question about SSL/TLS Elasticsearch elastic-stack-security	6	587	December 10, 2019
Elasticsearch 7.2 java client SSL configuration failing: bad_certificate Elasticsearch	3	1888	September 25, 2019
Adding certificate to keystore Elasticsearch elastic-stack-security	13	7296	March 7, 2023
ElasticSearch with SSL? Elasticsearch elastic-stack-security	12	21816	November 28, 2019
Correct use of SSL with Java REST API Elasticsearch elastic-stack-security	3	4831	August 9, 2019

Elasticsearch HTTPS and Adding to Java Rest Client

Related topics