Authentication to elasticsearch with curl and Authorization header -> OK
curl -vk -H 'Authorization: Basic xxxxx' "``https://$``{elasticsearch host}:9200/_security/user"
Authentication via the login page of Kibana -> OK
Authentication to kibana with curl and Authorization header -> NOK - HTTP return code 401 Unauthorized
curl -vk -H 'Authorization: Basic {base64-encoded string}' "https://127.0.0.1:8100/app/id/any*
Trying 127.0.0.1...
TCP_NODELAY set
Connected to 127.0.0.1 (127.0.0.1) port 8100 (#0)
ALPN, offering h2
ALPN, offering http/1.1
successfully set certificate verify locations:
CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
TLSv1.3 (OUT), TLS handshake, Client hello (1):
TLSv1.3 (IN), TLS handshake, Server hello (2):
TLSv1.3 (IN), TLS handshake, [no content] (0):
TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
TLSv1.3 (IN), TLS handshake, [no content] (0):
TLSv1.3 (IN), TLS handshake, Certificate (11):
TLSv1.3 (IN), TLS handshake, [no content] (0):
TLSv1.3 (IN), TLS handshake, CERT verify (15):
TLSv1.3 (IN), TLS handshake, [no content] (0):
TLSv1.3 (IN), TLS handshake, Finished (20):
TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
TLSv1.3 (OUT), TLS handshake, [no content] (0):
TLSv1.3 (OUT), TLS handshake, Finished (20):
SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
ALPN, server accepted to use h2
Server certificate:
subject: CN={common name}
start date: Apr 7 08:07:14 2026 GMT
expire date: Apr 7 08:07:14 2027 GMT
issuer: CN={common name}
SSL certificate verify ok.
Using HTTP2, server supports multi-use
Connection state changed (HTTP/2 confirmed)
Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
TLSv1.3 (OUT), TLS app data, [no content] (0):
TLSv1.3 (OUT), TLS app data, [no content] (0):
TLSv1.3 (OUT), TLS app data, [no content] (0):
Using Stream ID: 1 (easy handle 0x5607350046f0)
TLSv1.3 (OUT), TLS app data, [no content] (0):
GET /app/id/any* HTTP/2
Host: 127.0.0.1:8100
User-Agent: curl/7.61.1
Accept: /
Authorization: Basic {base64-encoded string}
TLSv1.3 (IN), TLS handshake, [no content] (0):
TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
TLSv1.3 (IN), TLS handshake, [no content] (0):
TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
TLSv1.3 (IN), TLS app data, [no content] (0):
Connection state changed (MAX_CONCURRENT_STREAMS == 4294967295)!
TLSv1.3 (OUT), TLS app data, [no content] (0):
TLSv1.3 (IN), TLS app data, [no content] (0):
TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/2 401
< www-authenticate: Basic realm="security", charset="UTF-8", Bearer realm="security", ApiKey
< x-content-type-options: nosniff
< referrer-policy: strict-origin-when-cross-origin
< permissions-policy: camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()
< cross-origin-opener-policy: same-origin
< content-security-policy: script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'report-sample' 'none'
< content-security-policy-report-only: form-action 'report-sample' 'self'; default-src 'report-sample' 'none'; font-src 'report-sample' 'self'; img-src 'report-sample' 'self' data: tiles.maps.elastic.co; connect-src 'report-sample' 'self' telemetry.elastic.co telemetry-staging.elastic.co feeds.elastic.co tiles.maps.elastic.co vector.maps.elastic.co; script-src 'report-sample' 'self'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'; object-src 'report-sample' 'none'
< kbn-name: {hostname}
< kbn-license-sig: {license-sig}
< refresh: 0;url=/login?msg=UNAUTHENTICATED&next=%2Fapp%2Fid%2Fany*
< content-type: text/html; charset=utf-8
< cache-control: private, no-cache, no-store, must-revalidate
< content-length: 891
< date: Mon, 18 May 2026 13:10:50 GMT
<
Kibana.yml
pid.file: "kibana.pid"
logging.appenders.default:
type: rolling-file
fileName: "kibana.log"
policy:
type: time-interval
interval: 24h
strategy:
type: numeric
max: 10
layout:
type: json
logging.loggers:
- name: elasticsearch.query
level: error
#ssl configuration
server.port: 8100
server.host: "127.0.0.1"
server.ssl.enabled: true
server.publicBaseUrl: {public base url}
server.ssl.keystore.path: server.p12
elasticsearch.hosts: "https://{elasticsearch hostname}:9200"
elasticsearch.username: {username}
elasticsearch.ssl.keystore.path: http_server.p12
elasticsearch.ssl.truststore.path: truststore.p12
elasticsearch.ssl.alwaysPresentCertificate: true
elasticsearch.ssl.verificationMode: full
#encryption keys
xpack.encryptedSavedObjects.encryptionKey: {encryptionKey}
xpack.reporting.encryptionKey: {encryptionKey}
xpack.security.encryptionKey: {encryptionKey}
Elasticsearch.yml
discovery.seed_hosts: [{host1},{host2},{host3}]
path.repo: [{path to repo}]
path.data: {path to data}
path.logs: {path to logs}
network.host: {network host}
cluster.name: {elasticsearch.clustername}
node.name: {node name}
indices.memory.index_buffer_size: 50%
indices.breaker.total.use_real_memory: false
http.port: 9200
transport.port: 9300
#ssl configuration
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: full
xpack.security.transport.ssl.keystore.path: cert/transport_server.p12
xpack.security.transport.ssl.truststore.path: cert/transport_truststore.p12
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: cert/http_server.p12
xpack.security.http.ssl.truststore.path: cert/http_truststore.p12
xpack.security.http.ssl.truststore.type: PKCS12
xpack.security.http.ssl.client_authentication: required
I just validated BUT I did think it did not work at first... simple error...