ElasticSearch with SSL?

xemyleex · October 25, 2019, 2:21pm

Hello, I am trying to configure elasticsearch with SSL, but I get these error,

I followed this tutorial:
https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-tls.html

So I created the Certificate Authority:
bin/elasticsearch-certutil ca

Then I generated the certificate and the private key:
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

Then I configurate elasticsearch.yml:
xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certss/elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certss/elastic-certificates.p12

Then I restarted elasticsearch:
systemctl start elasticsearch

But I get these errors:

# sudo tail -f /var/log/elasticsearch/elasticsearch.log
    java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin]
    ...
    Caused by: java.lang.reflect.InvocationTargetException
    ...
    Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.http.ssl]
    ...
    Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - not permitted to read truststore file [/etc/elasticsearch/certss/elastic-certificates.p12]
    ...
    Caused by: java.nio.file.AccessDeniedException: /etc/elasticsearch/certss/elastic-certificates.p12
    ...

This command says that that plugin is installed:
# sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack
ERROR: this distribution of Elasticsearch contains X-Pack by default

Any idea?

uher3805 · October 28, 2019, 8:09pm

Hi, I am encountering the same issue with elasticsearch 7.4.0 - in case you solved it I am interested to learn now, thanks

MiTschMR · October 29, 2019, 7:46am

Hi @xemyleex

If you read the error messages carefully, you can see that one is failed to initialize SSL TrustManager - not permitted to read truststore file [/etc/elasticsearch/certss/elastic-certificates.p12] and another is java.nio.file.AccessDeniedException: /etc/elasticsearch/certss/elastic-certificates.p12.

These messages already tell enough. The Elasticsearch process does not have sufficient permission to access the truststore file. Configure the permission accordingly and it should work.

Hope this helps.

xemyleex · October 30, 2019, 9:45am

Ok thanks, but now I get this error:

[2019-10-30T10:38:58,146][ERROR][o.e.b.Bootstrap          ] [localhost.localdomain] Exception
java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin]

....

Caused by: java.lang.reflect.InvocationTargetException

....

Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl]

....

Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager

....

Caused by: java.io.IOException: keystore password was incorrect
	at 

....

Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

....

Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl]

...

Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager

....

Caused by: java.io.IOException: keystore password was incorrect

....

Caused by: java.security.UnrecoverableKeyException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

ikakavas · October 30, 2019, 10:36am

Then as the error informs you, elastic-certificates.p12 is password protected and you don't configure elasticsearch with the password so it can't decrypt and read it. Read point 3 in the tutorial you followed

ikakavas · October 30, 2019, 10:37am

If you don't get exactly the same error message, then it probably is better for you to start a new thread, provide your configuration and the exact error message you are getting so that folk can more easily assist you

xemyleex · October 30, 2019, 4:36pm

Ok now it works thanks
Last question:
If I try to open this page in the browser:
https://localhost:9200

Then I get this error:
ssl_error_rx_record_too_long

Why?

ikakavas · October 30, 2019, 4:56pm

You have only configured transport layer for TLS, not the http layer ,so you cant access elasticsearch over https with your browser. Go back to the tutorial you are reading, it's all there

xemyleex · October 31, 2019, 11:18am

Thanks so much. I have last question
I tryed to open this page in the browser:
https://localhost:9200
And I get this:

So I tryed to insert the default username and password:

elastic
changeme

But it doesn't work because I get "failed to authenticate user [elastic]":

I tryed to change the password too but I get this:

$ sudo bin/elasticsearch-setup-passwords interactive
[sudo] password di emiliano: 

SSL connection to https://127.0.0.1:9200/_security/_authenticate?pretty failed: No subject alternative names present
Please check the elasticsearch SSL settings under xpack.security.http.ssl.

ERROR: Failed to establish SSL connection to elasticsearch at https://127.0.0.1:9200/_security/_authenticate?pretty.

This is my elasticsearch.yml ssl setting:

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path:  /etc/elasticsearch/certss/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certss/elastic-certificates.p12

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /etc/elasticsearch/certss/elastic-certificates.p12
xpack.security.http.ssl.truststore.path: /etc/elasticsearch/certss/elastic-certificates.p12

Any idea?

ikakavas · October 31, 2019, 11:31am

Please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable.

Instead, paste the text and format it with </> icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer.

It would be great if you could update your post to solve this.

xemyleex · October 31, 2019, 11:36am

Done

ikakavas · October 31, 2019, 11:42am

There hasn't been a default password for a few releases now:

The certificate you are using for TLS in the http layer, doesn't contain a SAN with the hostname or the IP address of the node (localhost) where elasticserach is running so elasticsearch-setup-passwords can't securely connect to it.

You can either:

Generate a new certificate and key in a new keystore for the http layer, using --dns or --ip as described in the blog you are following and use that for xpack.security.http.ssl.keystore.path and xpack.security.http.ssl.truststore.path
1. Set xpack.security.http.ssl.enabled: false
2. Restart elasticsearch
3. Run bin/elasticsearch-setup-passwords interactive again
4. Set xpack.security.http.ssl.enabled: true
5. Restart elasticsearch

system · November 28, 2019, 11:45am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Elasticsearch failed start when enable x-pack security Elasticsearch elastic-stack-security	13	2398	April 29, 2022
Failed to load SSL configuration [xpack.security.transport.ssl] - the truststore [/etc/elasticsearch/certs/root.p12] does not contain any trusted certificate entries Elasticsearch	3	51	September 19, 2024
Elasticsearch error when enable ssl/tls Elasticsearch elastic-stack-security	8	703	June 14, 2022
Problem with keystore password was incorrect Elasticsearch elastic-stack-security	7	38031	March 23, 2019
TLS/SSL on Elasticsearch (new version 7.1) (Basic License) Elasticsearch elastic-stack-security	5	881	June 24, 2019

ElasticSearch with SSL?

Related Topics