# How to generate a server certificate for Kibana?
**URL:** https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847
**Category:** Kibana
**Created:** [February 11, 2019, 12:28pm UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847 "2019-02-11T12:28:57Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)
#### Post date: [February 11, 2019, 12:28pm UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847/1 "2019-02-11T12:28:57Z")
In [https://www.elastic.co/guide/en/kibana/6.6/configuring-tls.html](https://www.elastic.co/guide/en/kibana/6.6/configuring-tls.html), it says:
Generate a server certificate for Kibana.
You must either set the certificate’s `subjectAltName` to the hostname, fully-qualified domain name (FQDN), or IP address of the Kibana server, or set the CN to the Kibana server’s hostname or FQDN. Using the server’s IP address as the CN does not work.
But how to generate the server certificate?
---
### Author:  [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)
#### Post date: [February 11, 2019, 11:55pm UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847/2 "2019-02-11T23:55:12Z")
The Kibana docs gloss over that part apparently, but the [elasticsearch docs go into detail about it](https://www.elastic.co/guide/en/elastic-stack-overview/6.6/ssl-tls.html). In general, `openssl` will work, but there's a lot of steps. Anything you can use to generate a valid X.509 certificate should work though.
As mentioned in those docs, we have a cert generation tool, called `elasticsearch-certutiledit` you can use as well, which is probably easier than just using openssl directly. You can [read more about that in the docs here too](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html).
Once you have the cert, you can follow the Kibana docs to actually start using it.
---
### Author:  [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)
#### Post date: [February 12, 2019, 1:43am UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847/3 "2019-02-12T01:43:54Z")
Should I generate a new server certificate for Kibana? Since I am deploying both Elasticsearch and Kibana in the same machine, can I use the same certificate that I generated for Elasticsearch node?
BTW, is the server certificate indispensable for TLS/SSL communication?
---
### Author:  [@Joe\_Fleming](https://discuss.elastic.co/u/Joe_Fleming)
#### Post date: [February 13, 2019, 7:58pm UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847/4 "2019-02-13T19:58:27Z")
I _think_ you can use the same cert for both, depending on how the cert was set up. It's been a long time since I've personally set up a cert, but if you use the same hostname (or a wildcard one), and it's valid for all ports on that host, then it should work. I'm not sure if it's "good practice" or not though, you'll have to find that answer yourself.
> BTW, is the server certificate indispensable for TLS/SSL communication?
If you're asking if you need a certificate for SSL, the answer is yes.
---
### Author:  [@li\_jessen2016](https://discuss.elastic.co/u/li_jessen2016)
#### Post date: [February 16, 2019, 7:41am UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847/5 "2019-02-16T07:41:56Z")
No. I tried using the same certificate and key as that of elasticsearch but it failed since kibana app can't parse them. I tried other ways and made it work.
> [@What does "A secure connection is required for log in" mean?](https://discuss.elastic.co/t/what-does-a-secure-connection-is-required-for-log-in-mean/168355/5):
>
> It is really not a simple task. It cost me around 6 hours to figure it out. Some facts are missing in the online documents of Elasticsearch. I am using CentOS 7, elasticsearch and kibana 6.5. (1) generate server certificate for kibana Use elasticsearch-certutil in the installation directory of elasticsearch, since kibana installation directory has no such utility details see: [https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html) But you need to create a yml file for …
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2019, 7:41am UTC](https://discuss.elastic.co/t/how-to-generate-a-server-certificate-for-kibana/167847/6 "2019-03-16T07:41:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.