# How do i self sign kibana certs

**URL:** https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 16, 2020, 8:30pm UTC](https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543 "2020-07-16T20:30:51Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sb116](https://avatars.discourse-cdn.com/v4/letter/s/ac8455/32.png) [@sb116](https://discuss.elastic.co/u/sb116)
#### Post date: [July 16, 2020, 8:30pm UTC](https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543/1 "2020-07-16T20:30:51Z")

</div>

I am working on configuring SSL for ES cluster and I am at the step to enable SSL for Kibana ([https://www.elastic.co/guide/en/kibana/7.8/configuring-tls.html](https://www.elastic.co/guide/en/kibana/7.8/configuring-tls.html)).

```auto
bin/elasticsearch-certutil csr -name kibana-server -dns some-website.com,www.some-website.com

```

created 2 files: `kibana-server.key and kibana-server.csr`

How do I self-sign kibana-server.csr?

---

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 17, 2020, 10:50am UTC](https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543/2 "2020-07-17T10:50:25Z")

</div>

> [@sb116](#):
>
> How do I self-sign kibana-server.csr?

If you want to sign your own certificates then you don't want to generate a CSR.  
You should use the `cert` option to certutil instead.

---

<div class="post-metadata">

### Author: ![sb116](https://avatars.discourse-cdn.com/v4/letter/s/ac8455/32.png) [@sb116](https://discuss.elastic.co/u/sb116)
#### Post date: [July 20, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543/3 "2020-07-20T18:52:40Z")

</div>

ok, with cert option, i get client.p12 self-signed cert, how do I get the following:  
`kibana.yml`

```auto
server.ssl.key:

server.ssl.certificate: <new client cert>

```

---

<div class="post-metadata">

### Author: ![sb116](https://avatars.discourse-cdn.com/v4/letter/s/ac8455/32.png) [@sb116](https://discuss.elastic.co/u/sb116)
#### Post date: [July 20, 2020, 7:17pm UTC](https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543/4 "2020-07-20T19:17:15Z")

</div>

@TimV -- I passed that point, by setting following in kibana.yml

```auto
elasticsearch.ssl.certificateAuthorities
server.ssl.truststore.path
server.ssl.keystore.path

```

but, I am not able to connect:

```auto
curl -sk -vvv "https://elb:5601/kibana/"
* Trying *******...
* TCP_NODELAY set
* Connected to elb ( ***** ) port 5601 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to elb:5601
* stopped the pause stream!
* Closing connection 0

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2020, 7:17pm UTC](https://discuss.elastic.co/t/how-do-i-self-sign-kibana-certs/241543/5 "2020-08-17T19:17:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.