# Full verification mode possible with self generated CA? **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [July 29, 2019, 1:30pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708 "2019-07-29T13:30:53Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![tombar](https://avatars.discourse-cdn.com/v4/letter/t/a9a28c/32.png) [@tombar](https://discuss.elastic.co/u/tombar)\ **Post date:** [July 29, 2019, 1:30pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/1 "2019-07-29T13:30:53Z")
I'm just getting started with securing Elastic Stack. My setup is a cloud VM where both Elasticsearch and Kibana are running. It is a one node setup right now. I generated a CA with certutil, and then generated a pkcs12 key for my Elasticsearch node using this CA. bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --name my-server01 --ip 192.168.0.1 (placeholder) --dns [my-server01.vpc.com](http://my-server01.vpc.com) I'v got Elasticsearch running with full host verification. Now I'm adding Kibana to the mix by converting the pkcs12 key from the CA to a pem file and it's working fine with elasticsearch.ssl.verificationMode: certificate. However once I set verificationMode to full Kibana can't discover Elasticsearch anymore. Isn't it possible to use full verification mode with a self generated CA or am I doing something wrong here? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 29, 2019, 2:10pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/2 "2019-07-29T14:10:59Z")
Hi, you need to give us a little more information. Relevant parts of your `kibana.yml` file would be a good start ! How did you go about doing the following ? > [@tombar](#): > > converting the pkcs12 key from the CA to a pem file and what setting in Kibana did you use the resulting PEM for ? > [@tombar](#): > > However once I set verificationMode to full Kibana can't discover Elasticsearch anymore. What errors do you see in the Elasticsearch logs or the Kibana logs ? ---
**Author:** ![tombar](https://avatars.discourse-cdn.com/v4/letter/t/a9a28c/32.png) [@tombar](https://discuss.elastic.co/u/tombar)\ **Post date:** [July 29, 2019, 6:16pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/3 "2019-07-29T18:16:39Z")
> [@ikakavas](#): > > How did you go about doing the following ? I was using OpenSSL as I couldn't create a PEM with certutil. `openssl pkcs12 -in CertificateName.p12 -out CertificateName.pem -nodes` > and what setting in Kibana did you use the resulting PEM for ? elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/my-server01.pem"] I tried to both put the PEM from the Elasticsearch node and from the elastic-stack-ca.pkcs12 here, neither works. > What errors do you see in the Elasticsearch logs or the Kibana logs ? > Jul 29 12:56:09 my-server01 kibana[18358]: {"type":"log","@timestamp":"2019-07-29T12:56:09Z","tags":["warning","elasticsearch","admin"],"pid":18358,"message":"Unable to revive connection [https://my-server01:9200/](https://my-server01:9200/)"} > Jul 29 12:56:09 my-server0101 kibana[18358]: {"type":"log","@timestamp":"2019-07-29T12:56:09Z","tags":["warning","elasticsearch","admin"],"pid":18358,"message":"No living connections"} ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 29, 2019, 7:54pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/4 "2019-07-29T19:54:49Z")
```auto openssl pkcs12 -in CertificateName.p12 -out CertificateName.pem -nodes ``` probably only got the server certificate out, and not the ca one. You can verify which certficate you got with ```auto openssl x509 -in CertificateName.pem -text -noout ``` You might need to run ```auto openssl pkcs12 -in CertificateName.p12 -out CertificateName.pem -nodes -cacerts ``` depending on what you see in the previous command. > [@tombar](#): > > I tried to both put the PEM from the Elasticsearch node and from the elastic-stack-ca.pkcs12 here, neither works. You can, unfortunately, only use PEM files for kibana, so setting the `PKCS#12` store wouldn't work. > [@tombar](#): > > ["warning","elasticsearch","admin"],"pid":18358,"message":"Unable to revive connection [https://my-server01:9200/](https://my-server01:9200/)"} That error ( if it;s the only one ) seems to indicate that Elasticsearch is not up and running. What are the content of the elasticsearch logs. Any errors there? Can you verify that Elasticsearch does indeed start ? ---
**Author:** ![tombar](https://avatars.discourse-cdn.com/v4/letter/t/a9a28c/32.png) [@tombar](https://discuss.elastic.co/u/tombar)\ **Post date:** [July 30, 2019, 1:30pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/5 "2019-07-30T13:30:56Z")
> [@ikakavas](#): > > probably only got the server certificate out, and not the ca one. You can verify which certficate you got with I think I've got both. However there's an unsupported tag 6, maybe that's a problem? ``` Bag Attributes friendlyName: my-server01 localKeyID: 123456789 subject=CN = my-server01 issuer=CN = Elastic Certificate Tool Autogenerated CA -----BEGIN CERTIFICATE----- XYZ -----END CERTIFICATE----- Bag Attributes friendlyName: ca 2.16.840.1.113894.746875.1.1: subject=CN = Elastic Certificate Tool Autogenerated CA issuer=CN = Elastic Certificate Tool Autogenerated CA -----BEGIN CERTIFICATE----- XYZ -----END CERTIFICATE----- ``` > You can, unfortunately, only use PEM files for kibana, so setting the `PKCS#12` store wouldn't work. Sorry, I meant I tried to use the converted PEM of the elastic-stack-ca.pkcs12, but as that is missing the server information this won't work in full verification mode I guess. > That error ( if it;s the only one ) seems to indicate that Elasticsearch is not up and running. What are the content of the elasticsearch logs. Any errors there? Can you verify that Elasticsearch does indeed start ? Elasticsearch is definitely running, I get correct responses to curl commands. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 30, 2019, 1:41pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/6 "2019-07-30T13:41:13Z")
You can just leave the last part in the PEM file: ```auto -----BEGIN CERTIFICATE----- XYZ -----END CERTIFICATE----- ``` that's all you need. If this doesn't solve your problem, then I'd need to see more of your kibana logs. there _should_ be something more apart from the line you shared. > [@tombar](#): > > Elasticsearch is definitely running, I get correct responses to curl commands. What is the `curl` command you are running ? ---
**Author:** ![tombar](https://avatars.discourse-cdn.com/v4/letter/t/a9a28c/32.png) [@tombar](https://discuss.elastic.co/u/tombar)\ **Post date:** [July 30, 2019, 1:56pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/7 "2019-07-30T13:56:44Z")
> [@ikakavas](#): > > that's all you need. If this doesn't solve your problem, then I'd need to see more of your kibana logs. there _should_ be something more apart from the line you shared. You are right: ``` Jul 30 13:49:38 my-server01 kibana[21691]: {"type":"log","@timestamp":"2019-07-30T13:49:38Z","tags": ["status","plugin:ui_metric@7.2.0","info"],"pid":21691,"state":"green", "message":"Status changed from uninitialized to green - Ready","prevState":"uninitialized","prevMsg":"uninitialized"} Jul 30 13:49:39 my-server01 kibana[21691]: {"type":"log","@timestamp":"2019-07-30T13:49:39Z", "tags":["error","elasticsearch","admin"],"pid":21691,"message":"Request error, retrying\nGET https://my-server01:9200/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip => Hostname/IP does not match certificate's altnames: Host: my-server01. is not in the cert's altnames: IP Address:[replaced host ip address], DNS:my-server01.privatecloud.com"} ``` It seems I made an error when generating the server certificate. > What is the `curl` command you are running ? I'm just running a GET on Elasticsearch's Port with basic authentication with _elastic_ user. I'm actually using Postman and am converting the curl commands as documented. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 30, 2019, 2:22pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/8 "2019-07-30T14:22:33Z")
> [@tombar](#): > > It seems I made an error when generating the server certificate. Nice! Not that you made an error 🙂 but that it looks like your issue might have a simple solution. > [@tombar](#): > > I'm just running a GET on Elasticsearch's Port with basic authentication with _elastic_ user. The only reason I'm asking you to share them is for us to get a mutual understanding of how the setup is and what errors you get. i.e. , if you run ```auto curl -k -u elastic:password https://IP_ADDRESS:port ``` and this is successful, it doesn't mean much if your kibana settings say i.e. ```auto elasticsearch.url: https://FDQN:port elasticsearch.username: kibana elasticsearch.password: otherpassword ``` because your curl command checks with a different user, without validating the certificate the server presents and using the IP address to connect to the Elasticsearch server instead of the IP address ( that latter might also affect the certificate validation ). It's _always_ better if you can share the exact command and the exact output/error/log , rather than a description of them. ---
**Author:** ![tombar](https://avatars.discourse-cdn.com/v4/letter/t/a9a28c/32.png) [@tombar](https://discuss.elastic.co/u/tombar)\ **Post date:** [July 30, 2019, 2:27pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/9 "2019-07-30T14:27:39Z")
Yes, I see your point. Unfortunately I have to anonymize a lot of things which makes it a little annoying to share logs. I'll have a look at how I generated the certificate again, I'm not sure right now where the error is. ---
**Author:** ![tombar](https://avatars.discourse-cdn.com/v4/letter/t/a9a28c/32.png) [@tombar](https://discuss.elastic.co/u/tombar)\ **Post date:** [July 30, 2019, 2:30pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/10 "2019-07-30T14:30:27Z")
Well, your last suggestion did it! 😄 I didn't know I had to use the FQDN in kibana.yml. Now everything is working perfectly! Thank you very much for your support. So should I use the FQDN for Elasticsearch for every part of Elastic Stack? Also the beats? They don't seem to use full host verification however... ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [July 30, 2019, 2:43pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/11 "2019-07-30T14:43:26Z")
> [@tombar](#): > > I didn't know I had to use the FQDN in kibana.yml. You don't have to. The other two possibilities would be to a. Add the IP address as a SAN in the certificate b. Disable the hostname verification ( not actually suggesting it as a good idea ) Same goes for beats or other stack products talking to Elasticsearch (or any other external system talking to any server over TLS with hostname verification on). Either add the IP Address of the server as a SAN in the the certificate and connect to the IP address, or connect to the FQDN (which I assume is already a SAN in the server certificate ) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 27, 2019, 2:43pm UTC](https://discuss.elastic.co/t/full-verification-mode-possible-with-self-generated-ca/192708/12 "2019-08-27T14:43:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.