# How to setup pki auth for kibana and elasticsearch **URL:** \ **Category:** Kibana\ **Created:** [October 30, 2018, 9:53pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729 "2018-10-30T21:53:40Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 30, 2018, 9:53pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/1 "2018-10-30T21:53:40Z")
Hello. I would like to set Kibana to use PKI auth instead of username/password. I have added realms in elasticsearch.yml file. but it dint work . ``` ` elasticsearch.yml cluster.name: cluster node.master: false node.data: false node.name: es-coordinating node.ingest: false network.host: 0.0.0.0 discovery.zen.minimum_master_nodes: 1 discovery.zen.ping.unicast.hosts: ["es-coordinating","es-master","es-data"] node.ml: false xpack.security.enabled: true xpack: security: authc: realms: pki1: type: pki xpack.ml.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/tls_server/tls_server/key.pem xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/tls_server/tls_server/crt.pem xpack.security.transport.ssl.certificate_authorities: ["/usr/share/elasticsearch/config/certs/CA.crt"] xpack.security.http.ssl.enabled: true xpack.security.http.ssl.key: /usr/share/elasticsearch/config/tls_server/tls_server/key.pem xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/tls_server/tls_server/crt.pem xpack.security.http.ssl.certificate_authorities: ["/usr/share/elasticsearch/config/certs/CA.crt"]` ``` kibana.yaml ` kibana.yaml ``` server: name: "kibana" host: 0.0.0.0 port: 5601 elasticsearch.url: "https://es-coordinating:9200" xpack.security.enabled: true server.ssl.enabled: true server.ssl.key: /usr/share/kibana/config/tls_server/tls_server/key.pem server.ssl.certificate: /usr/share/kibana/config/tls_server/tls_server/crt.pem elasticsearch.ssl.certificateAuthorities: /usr/share/kibana/config/certs/CA.crt` ``` ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [October 30, 2018, 9:59pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/2 "2018-10-30T21:59:56Z")
Hey @rmadoori, you can use PKI to authenticate the internal Kibana server user with Elasticsearch, but it's not possible to authenticate the actual logged in end-users with Elasticsearch, yet. We're tracking that effort here: [https://github.com/elastic/kibana/issues/7341](https://github.com/elastic/kibana/issues/7341) To get the Kibana server user authenticating using PKI, you'll need to set the `elasticsearch.ssl.certificate` and `elasticsearch.ssl.key` settings in your kibana.yml. ---
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 30, 2018, 10:06pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/3 "2018-10-30T22:06:50Z")
> [@Brandon\_Kobel](#): > > elasticsearch.ssl.certificate Thanks for Prompt Response . should i set transport.ssl.certificate or http.ssl.certificate ? in kibana ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [October 30, 2018, 10:13pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/4 "2018-10-30T22:13:18Z")
In your kibana.yml, you set `elasticsearch.ssl.certificate: /path/to/cert.crt` and `elasticsearch.ssl.key: /path/to/key.key` In your elasticsearch.yml, you set `xpack.security.http.ssl.client_authentication: optional` ---
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 30, 2018, 10:28pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/5 "2018-10-30T22:28:46Z")
> [@Brandon\_Kobel](#): > > elasticsearch.ssl.key Hi, I have added the setting in kibana.yaml ``` ` name: "kibana" host: 0.0.0.0 port: 5601 elasticsearch.url: "https://es-coordinating:9200" xpack.security.enabled: true server.ssl.enabled: true server.ssl.key: /usr/share/kibana/config/tls_server/tls_server/key.pem server.ssl.certificate: /usr/share/kibana/config/tls_server/tls_server/crt.pem elasticsearch.ssl.certificateAuthorities: /usr/share/kibana/config/certs/CA.crt elasticsearch.ssl.certificate: /usr/share/kibana/config/certs/cert.crt elasticsearch.ssl.key: /usr/share/kibana/config/certs/key.key` ``` but still i am getting this error: ``` `{"type":"log","@timestamp":"2018-10-30T22:27:06Z","tags":["license","warning","xpack"],"pid":1,"message":"License information from the X-Pack plugin could not be obtained from Elasticsearch for the [data] cluster. [security_exception] missing authentication token for REST request [/_xpack], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } :: {\"path\":\"/_xpack\",\"statusCode\":401,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication token for REST request [/_xpack]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication token for REST request [/_xpack]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}},\\\"status\\\":401}\",\"wwwAuthenticateDirective\":\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"}"}` ``` ---
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 30, 2018, 10:31pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/6 "2018-10-30T22:31:56Z")
![20%20PM](https://us1.discourse-cdn.com/elastic/original/3X/f/a/faf44c1c138f18e1910c9e517a13b7aff272b3b2.png) ---
**Author:** ![rmadoori](https://avatars.discourse-cdn.com/v4/letter/r/47e85d/32.png) [@rmadoori](https://discuss.elastic.co/u/rmadoori)\ **Post date:** [October 31, 2018, 4:17am UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/7 "2018-10-31T04:17:19Z")
Hi, I have updated this in my config ``` `xpack: security: authc: realms: pki1: type: pki certificate_authorities: "/usr/share/elasticsearch/config/certs/CA.crt" enabled: true` ``` but still kibana is not able to connect ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [November 2, 2018, 1:36pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/8 "2018-11-02T13:36:37Z")
@rmadoori, what error are you seeing? Have you tried using `curl` and the `--cert` and `--key` arguments to ensure you're able to authenticate against Elasticsearch using the certificate and key that you've specified? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 30, 2018, 1:36pm UTC](https://discuss.elastic.co/t/how-to-setup-pki-auth-for-kibana-and-elasticsearch/154729/9 "2018-11-30T13:36:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.