Note: I will regenerate all passwords, certs and ect in my final install since I have provided all that information here.
Environment
Windows 10 Enterprises
Elasticsearch Version : 6.1.1 (elasticsearch-6.1.1.zip)
Kibana Version: 6.1.1 (kibana-6.1.1-windows-x86_64.zip)
Subscriptions : Platinum
Problem:
I am trying to enabled SSL in kibana and I am running into an issue. I cant for the life of me figure out what I have done wrong. Here are the steps I have taken so far.
- Create Yaml file use with the certutil
--inflag.
instances: - name: node1 dns: ['node1.local'] - name: devws-kibana dns: ['devws-kibana.local']
- Declare variables for use in powershell commands
$root = "C:\working\elasticsearch" [Version]$esVersion = "6.1.1" $es = "$root\elasticsearch-$($esVersion.ToString())" $esService = "elasticsearch_$($esVersion.ToString() -replace '\.','')" [Version]$KibanaVersion = "6.1.1" $kibana = "$root\kibana-$($KibanaVersion.ToString())-windows-x86_64" $kibanaService = "elasticsearch-kibana$($KibanaVersion.ToString() -replace '\.','')"
- Install x-pack in elasticsearch
`&"$es\bin\elasticsearch-plugin.bat" install x-pack --batch`
- Create a Self Signed CA certificate.
&"$es\bin\x-pack\certutil.bat" ca --silent --pass password --ca-dn "CN=Elasticsearch-DevWS" --pem --out "$root\elastic-stack-ca.zip" Expand-Archive -Path "$root\elastic-stack-ca.zip" -OutputPath "$root\certs"
- Create a cert for elasticsearch and kibana
&"$es\bin\x-pack\certutil.bat" cert --silent --pem --ca-cert "$root\certs\ca\ca.crt" --ca-key "$root\certs\ca\ca.key" -in "$root\instances.yml" --ca-pass password --pass password --out "$root\certificate-bundle.zip" Expand-Archive -Path "$root\certificate-bundle.zip" -OutputPath "$root\certs"
- Copy Certs to proper directories
Copy-Item -Path "$root\certs\ca\ca.crt" -Destination "$es\config\certs\ca.crt" Copy-Item -Path "$root\certs\node1\*" -Destination "$es\config\certs\" Copy-Item -Path "$root\certs\ca\ca.crt" -Destination "$kibana\config\certs\ca.crt" Copy-Item -Path "$root\certs\devws-kibana\*" -Destination "$kibana\config\certs\"
- Update Elasticsearch.yml to below
cluster.name: WRK001 node.name: node1 network.host: node1.local http.port: 9210 discovery.zen.ping.unicast.hosts: [ 'node1.local' ] processors: 2 node.master: true node.data: true node.max_local_storage_nodes: 1 xpack.ssl.key: certs/node1.key xpack.ssl.certificate: certs/node1.crt xpack.ssl.certificate_authorities: certs/ca.crt xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: full xpack.security.http.ssl.enabled: true xpack.ssl.key_passphrase: password
- Add secure key passphrase to keystore
"password" | &"$es\bin\elasticsearch-keystore.bat" add xpack.ssl.secure_key_passphrase --stdin &"$es\bin\elasticsearch-keystore.bat" list
-
Start Elasticsearch
-
Set password for build in accounts
$url = https://node1.local:9210/ $output = & cmd.exe /C "$es\bin\x-pack\setup-passwords.bat auto --url $url -batch" 2>&1 Write-Host -ForegroundColor Green -BackgroundColor Black $output
- Parse passwords from response and save to temp files.
$elasticPassword = ($output | Select-String -Pattern "^PASSWORD\selastic\s=\s(.*)$" -AllMatches).Matches[0].Groups[1].Value $kibanaPassword = ($output | Select-String -Pattern "^PASSWORD\skibana\s=\s(.*)$" -AllMatches).Matches[0].Groups[1].Value $elasticPassword | Out-File -FilePath "$es\config\elastic.password" -Encoding utf8 $kibanaPassword | Out-File -FilePath "$kibana\config\kibana.password" -Encoding utf8
-
Remove setting
xpack.ssl.key_passphrasefrom Elasticsearch.yml -
Restart Elasticsearch
-
Verify Elasticsearch is work (and it is)
-
Install X-Pack in kibana
&"$kibana\bin\kibana-plugin.bat" install x-pack
- Update Kibana.yml to below
server.name: devws-kibana server.host: devws-kibana.local elasticsearch.url: https://node1.local:9210/ elasticsearch.username: kibana elasticsearch.password: nWD0zPDLFiM3yHdVQM9j elasticsearch.ssl.certificateAuthorities: ../config/certs/ca.crt
-
Start Kibana
-
Verify Kibana is running and I am able to log in with elastic user
-
Stop Kibana
-
Update Kibana.yml to below
server.name: devws-kibana server.host: devws-kibana.local server.ssl.enabled: true server.ssl.certificate: ../config/certs/devws-kibana.key server.ssl.key: ../config/certs/devws-kibana.crt elasticsearch.url: https://node1.local:9210/ elasticsearch.username: kibana elasticsearch.password: nWD0zPDLFiM3yHdVQM9j elasticsearch.ssl.certificateAuthorities: ../config/certs/ca.crt xpack.security.encryptionKey: 3qrb1xee9ue9rrh3p93ykj28otgp676iu0l8ziifjopfov6h4sv9jhyp49gpm90t
- Try starting kibana. It fails and produces the following error.
FATAL Error: error:0906D06C:PEM routines:PEM_read_bio:no start line at Error (native) at Object.createSecureContext (_tls_common.js:69:17) at Server (_tls_wrap.js:776:25) at new Server (https.js:26:14) at Object.exports.createServer (https.js:47:10) at new module.exports.internals.Connection (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\node_modules\hapi\lib\connection.js:88:74) at internals.Server.connection (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\node_modules\hapi\lib\server.js:142:24) at KbnServer.exports.default (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\http\setup_connection.js:43:10) at C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:171:20 at next (native) at step (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:87:191) at C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:87:437 at C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:87:99 at KbnServer.mixin (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:187:7) at KbnServer.<anonymous> (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\http\index.js:66:21) at next (native)
