# How to generate certificate to enable alerting in Kibana?
**URL:** https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [November 17, 2020, 10:07am UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658 "2020-11-17T10:07:50Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 17, 2020, 10:07am UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658/1 "2020-11-17T10:07:50Z")
Hi,
As documented **[here](https://www.elastic.co/guide/en/kibana/7.9/alert-action-settings-kb.html)**, I understand that there are 3 main steps / prerequisites to enable alerting in Kibana;
1. [Set up Kibana to work with Elastic Stack security features](https://www.elastic.co/guide/en/kibana/7.9/using-kibana-with-security.html).
2. [Set up TLS encryption between Kibana and Elasticsearch](https://www.elastic.co/guide/en/kibana/7.9/configuring-tls.html#configuring-tls-kib-es).
3. [Specify a value for `xpack.encryptedSavedObjects.encryptionKey`](https://www.elastic.co/guide/en/kibana/7.9/alert-action-settings-kb.html#general-alert-action-settings).
I have a 3 node cluster. I generated `elastic-stack-ca.p12` in one node, gave pass phrase, and copied it to all other nodes. Then I generated `elastic-certificates.p12` in every node using the other `elastic-stack-ca.p12` file. Then I copied `elastic-stack-ca.p12` to `config` directory and created a `certs` inside that for `elastic-certificates.p12`. I believe I have completed step 1.
For step 2, I gave the below configurations in kibana.yml
```
elasticsearch.username: "kibana_system"
elasticsearch.password: "password"
xpack.security.session.idleTimeout: "1h"
xpack.security.session.lifespan: "30d"
```
I started kibana, and presented the login page, and the credentials works just fine. Now, as per the [documentation](https://www.elastic.co/guide/en/kibana/7.9/alert-action-settings-kb.html), i was doing [step 2](https://www.elastic.co/guide/en/kibana/7.9/configuring-tls.html#configuring-tls-kib-es), to [Enable TLS on the HTTP layer in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/configuring-tls.html#tls-http) . Now I have one Kibana node and 3 elasticsearch nodes. What all steps do I need to perform to generate certificates to integrate it with Kibana, so that I can proceed with alerting?
If any information is missing, I can provide it.
Thanks.
---
### Author:  [@jportner](https://discuss.elastic.co/u/jportner)
#### Post date: [November 19, 2020, 8:53pm UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658/2 "2020-11-19T20:53:13Z")
> [@elasticheart](#):
>
> I started kibana, and presented the login page, and the credentials works just fine. Now, as per the [documentation](https://www.elastic.co/guide/en/kibana/7.9/alert-action-settings-kb.html), i was doing [step 2](https://www.elastic.co/guide/en/kibana/7.9/configuring-tls.html#configuring-tls-kib-es), to [Enable TLS on the HTTP layer in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/configuring-tls.html#tls-http) . Now I have one Kibana node and 3 elasticsearch nodes. What all steps do I need to perform to generate certificates to integrate it with Kibana, so that I can proceed with alerting?
Actually, since you already generated certificates to encrypt communications between your cluster nodes on the transport layer, you can use the same certificates on the HTTP layer!
In each of your cluster nodes, add this to your elasticsearch.yml:
```yml
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: "/path/to/elastic-certificates.p12"
xpack.security.http.ssl.keystore.password: "your keystore password"
```
Then, you need to extract the CA certificate so Kibana knows it can trust these server certificates. Run this command:
```sh
openssl pkcs12 -in elastic-certificates.p12 -cacerts -nokeys -out elasticsearch-ca.pem
```
Copy that PEM file over to your Kibana server, and add this to your kibana.yml:
```yml
elasticsearch.ssl.certificateAuthorities: ["/path/to/elasticsearch-ca.pem"]
```
Edit: as per the docs: [API Keys | Kibana Guide [master] | Elastic](https://www.elastic.co/guide/en/kibana/master/api-keys.html#api-keys-service)
> The Elasticsearch API key service is automatically enabled when you configure [TLS on the HTTP interface](https://www.elastic.co/guide/en/elasticsearch/reference/master/configuring-tls.html#tls-http). This ensures that clients are unable to send API keys in clear-text.
So you don't need to take any additional steps to enable the API key service once you've enabled TLS on the HTTP layer.
---
### Author:  [@elasticheart](https://discuss.elastic.co/u/elasticheart)
#### Post date: [November 20, 2020, 5:06am UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658/3 "2020-11-20T05:06:42Z")
Thank you so much @jportner for sparing your valuable time in helping me 🙂
---
### Author:  [@jportner](https://discuss.elastic.co/u/jportner)
#### Post date: [November 20, 2020, 3:08pm UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658/4 "2020-11-20T15:08:29Z")
You're very welcome!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 18, 2020, 3:08pm UTC](https://discuss.elastic.co/t/how-to-generate-certificate-to-enable-alerting-in-kibana/255658/5 "2020-12-18T15:08:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.