Hello All,
I configured 4 node Elasticsearch cluster. 1 -M, 2-M/D and 1 - D nodes. I have encrypted TLS using p12 and generated pem to get the organisation signed certificates.
Certificate was generated as below.
./keytool -genkeypair -alias elastic-dev1 -keyalg RSA -sigalg SHA256withRSA -keysize 2048 -keypass <> -storepass <> -validity 3650 -keystore elastic-dev1.jks -dname "CN=dev1.search.ocv.example.com, OU=Data, O=example Banking Group, L=Melbourne, ST=VIC, C=AU" -ext SAN=DNS:dev1.search.ocv.example.com,DNS:delaa01l.unix.example,DNS:delaa02l.unix.example
Generate .pem certificate
./keytool -certreq -alias elastic-dev1 -file certreq.pem -keystore elastic-dev1.jks -ext SAN=DNS:dev1.search.ocv.example.com,DNS:delaa01l.unix.example,DNS:delaa02l.unix.example
Create a directory 'certs' at the location '/app/elasticsearch/config' and copy the elastic-dev1.jks file into certs directory
Raise a request for CA signer certificates. Click on the below url and follow the steps mentioned in the section "Request for CA Signer certificate"
Once we receive the certificate then download all the internal certs (dev1.search.ocv.example.com, example_GlobalTest_Root_CA_v2.cer and example_GlobalTest_CA_02_v2.cer) to the location ''/app/elastic/config/certs' of elastic server.
executed the below commands
./keytool -importcert -file example_GlobalTest_Root_CA_v2.cer -keystore elastic-dev1.jks -alias "example_GlobalTest_Root_CA_v2"
./keytool -importcert -file example_GlobalTest_CA_02_v2.cer -keystore elastic-dev1.jks -alias "example_GlobalTest_CA_02_v2"
./keytool -importcert -file dev1.search.ocv.example.com.cer -keystore elastic-dev1.jks -alias "dev1.search.ocv.example.com"
./keytool -importkeystore -srckeystore elastic-dev1.jks -destkeystore elastic-dev1.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD_PKCS12]
openssl pkcs12 -in elastic-dev1.p12 -out client-ca.pem -clcerts -nokeys
Copy all certs to /etc/elasticsearch/certs and created soft-link to config location.
Done in all nodes.
Cluster is able to start, however getting below error..
[2021-02-25T00:18:12,396][WARN ][o.e.t.TcpTransport ] [delaa11l.unixtest.anz] exception caught on transport layer [Netty4TcpChannel{localAddress=/10.204.194.22:9384, remoteAddress=/10.204.194.22:41768}], closing connection
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~[netty-codec-4.1.49.Final.jar:4.1.49.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-codec-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:615) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:578) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-transport-4.1.49.Final.jar:4.1.49.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [netty-common-4.1.49.Final.jar:4.1.49.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.49.Final.jar:4.1.49.Final]
at java.lang.Thread.run(Thread.java:832) [?:?]
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
[elastic@delaa11l /app/elastic/fmp-e2e2/elasticsearch/config] $ curl -XGET 'https://delaa11l.unixtest.anz:9284/_cluster/health?pretty' -H'Content-Type: application/json'
curl: (60) Issuer certificate is invalid.
More details here: http://curl.haxx.se/docs/sslcerts.html
curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.