Kibana https ssl crt not working

[katara]

Hi All,
i am facing an issue converting my Kibana url to a secured url.

Here's what i did:
Method 1:

1. created a .csr and .key file in my elastic cluster.
2. provided this .csr and .key file to my certificate team and received the .crt file.
3. Moved these files to kibana server and Provided the path of .crt and .key file in kibana.yml after enabling the ssl.
4. saved and restarted the server.

Error: Site cannot be reached.

Method 2:

1. Created a .csr with the IIS in my kibana server.
2. provided this .csr and .key file to my certificate team and received the .crt file.
3. Moved these files to kibana server and Provided the path of .crt file in kibana.yml after enabling the ssl. No Key was given.
4. Restarted the service.

Error: Site cannot be reached.

Method 3:

1. after creating a .csr and .key from elastic cluster, i used a open ssl command to generate a self signed certificate.

Error: URL worked but it was not secure.

Kibana .yml:

# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 443

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "10.166.75.201"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.
# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath
# from requests it receives, and to prevent a deprecation warning at startup.
# This setting cannot end in a slash.
#server.basePath: ""

# Specifies whether Kibana should rewrite requests that are prefixed with
# `server.basePath` or require that they are rewritten by your reverse proxy.
# This setting was effectively always `false` before Kibana 6.3 and will
# default to `true` starting in Kibana 7.0.
#server.rewriteBasePath: false

# The maximum payload size in bytes for incoming server requests.
#server.maxPayloadBytes: 1048576

# The Kibana server's name.  This is used for display purposes.
server.name: "elk01"

# The URLs of the Elasticsearch instances to use for all your queries.
elasticsearch.hosts: ["http://10.106.35.207:9200"]

# When this setting's value is true Kibana uses the hostname specified in the server.host
# setting. When the value of this setting is false, Kibana uses the hostname of the host
# that connects to this Kibana instance.
#elasticsearch.preserveHost: true

# Kibana uses an index in Elasticsearch to store saved searches, visualizations and
# dashboards. Kibana creates a new index if the index doesn't already exist.
#kibana.index: ".kibana"

# The default application to load.
#kibana.defaultAppId: "home"

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
elasticsearch.username: "kibana"
elasticsearch.password: "e@13"

# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
server.ssl.enabled: true
server.ssl.certificate: D:\kibana-7.2.0-windows-x86_64\Kibana-cert\kibana.crt
# server.ssl.key: D:\kibana-7.2.0-windows-x86_64\Kibana-cert\kibana-cert.key
# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
# These files validate that your Elasticsearch backend uses the same key files.
#elasticsearch.ssl.certificate:
#elasticsearch.ssl.key: 

# Optional setting that enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
#elasticsearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]

# To disregard the validity of SSL certificates, change this setting's value to 'none'.
#elasticsearch.ssl.verificationMode: full

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
#elasticsearch.pingTimeout: 1500

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
#elasticsearch.requestTimeout: 30000

# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
# headers, set this value to [] (an empty list).
#elasticsearch.requestHeadersWhitelist: [ authorization ]

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
#elasticsearch.customHeaders: {}

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
#elasticsearch.shardTimeout: 30000

# Time in milliseconds to wait for Elasticsearch at Kibana startup before retrying.
#elasticsearch.startupTimeout: 5000

# Logs queries sent to Elasticsearch. Requires logging.verbose set to true.
#elasticsearch.logQueries: false

# Specifies the path where Kibana creates the process ID file.
#pid.file: /var/run/kibana.pid

# Enables you specify a file where Kibana stores log output.
#logging.dest: stdout

# Set the value of this setting to true to suppress all logging output.
#logging.silent: false

# Set the value of this setting to true to suppress all logging output other than error messages.
#logging.quiet: false

# Set the value of this setting to true to log all events, including system usage information
# and all requests.
#logging.verbose: false

# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000.
#ops.interval: 5000

# Specifies locale to be used for all localizable strings, dates and number formats.
#i18n.locale: "en"

What should i do to have a secured connection, I have to do some tweaks in my method 1 or 2.
Guide me on my resolution!

Thanks!

Katara

[Dzmitry]

Hi @katara

Please add more details on how do you generate cert, e.g. the command

You can also check elasticsearch-certutil and documentation on how to secure the cluster

Dzmitry

[katara]

Hi @Dzmitry,
I did utilise the elasticsearch-certutil to create the .csr and . key files.
Later I created the self signed.crt with

> openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt

However, this generates a certificate that's not secured, yet the url works.

My organization has a pki system which got me a certificate created by them using the csr I provided. Not sure how they create a certificate from their end.
I can however check with them and update.

Thanks!
Katara