Well, obviously if you disabled security entirely then there is no longer a login page, and consequently you don't get a warning message on that (non-existent) login page.
But that warning isn't caused by enabling security, it is caused by enabling secure cookies without using a secure (https) channel between the browser and Kibana.
You can also make that message go away by shutting down your Elasticsearch cluster. In that case you will get a "Cannot connect to Elasticsearch" error, rather than a "secure connection" error. But that doesn't mean that this error is caused by having your Elasticsearch cluster online.
To try and summarise what we have been trying to explain in this thread.
- If you enabled TLS on the HTTP (Rest) interface for Elasticsearch, then you also need to configure Kibana to communicate with Elasticsearch over
- Depending on how you configured TLS in Elasticsearch, you will probably also need to configure some
- None of that requires that you enable
https for Kibana access (
- You can, and probably should, configure Kibana to use ssl (via
server.ssl.key), but it is not required.
- If you enable secure cookies in Kibana (
xpack.security.secureCookies: true), then you will need to enable
https in Kibana, either through a proxy or via
- If you have security enabled in the Elastic Stack, and enable secure cookies in Kibana but do not use
https then you will get the a secured connection is required error on the login page. This is true, regardless of whether Kibana is using
https to connect to Elasticsearch (that is, whether
elasticsearch.hosts is a
https URL in kibana.yml, and whether
xpack.security.http.ssl.enabled is true in elasticsearch.yml).
You keep trying to tell us that our advice is wrong, but you haven't provided any example configuration files to show what you have tried to set up.
When we try and explain what is happening, you seem to ignore what we are telling you, and argue with about how you tried and it didn't work (but never show us what you tried, and how that relates to our explanations).
We have invested a lot of time into trying to help you solve this problem. If you want our assistance then please listen to what we are telling you, show us how you have tried to implement it, and stop arguing that we're wrong.