Hi @stephenb yes, you understood that correctly.
So I tried the curl command with the kibana_system as well as the elastic user and got the following output:
* Trying 172.16.10.55:9200...
* Connected to ELASTIC-01 (172.16.10.55) port 9200 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/kibana/certs/ca.pem
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=DE; ST=Berlin; L=Berlin; O=mycompany; emailAddress=security@mycompany.com; CN=ELASTIC-01
* start date: Jan 11 10:50:36 2023 GMT
* expire date: Feb 12 10:50:36 2024 GMT
* subjectAltName does not match ELASTIC-01
* SSL: no alternative certificate subject name matches target host name 'ELASTIC-01'
* Closing connection 0
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS alert, close notify (256):
curl: (60) SSL: no alternative certificate subject name matches target host name 'ELASTIC-01'
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Since it says no alternative certificate subject name matches target host name 'ELASTIC-01' I tried the request again but with the fqdn "ELASTIC-01.zonelocal", which is in the certficiates subject alternative names. Now
the request is succesful:
* Trying 172.16.10.55:9200...
* Connected to ELASTIC-01.zonelocal (172.16.10.55) port 9200 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/kibana/certs/ca.pem
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
* subject: C=DE; ST=Berlin; L=Berlin; O=mycompany; emailAddress=security@mycompany.com; CN=ELASTIC-01
* start date: Jan 11 10:50:36 2023 GMT
* expire date: Feb 12 10:50:36 2024 GMT
* subjectAltName: host "ELASTIC-01.zonelocal" matched cert's "ELASTIC-01.zonelocal"
* issuer: C=DE; ST=Berlin; L=Berlin; O=mycompany; emailAddress=security@mycompany.com; CN=companyca
* SSL certificate verify ok.
* Server auth using Basic with user 'kibana_system'
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/1.1
> Host: ELASTIC-01.zonelocal:9200
> Authorization: Basic a2liYW5hX3N5c3RlbTpxd2VydHo=
> User-Agent: curl/7.81.0
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< X-elastic-product: Elasticsearch
< content-type: application/json
< content-length: 535
<
{
"name" : "ELASTIC-01",
"cluster_name" : "cluster",
"cluster_uuid" : "zZGLy3EfSUqrlw_H3EWORg",
"version" : {
"number" : "8.6.0",
"build_flavor" : "default",
"build_type" : "deb",
"build_hash" : "f67ef2df40237445caa70e2fef79471cc608d70d",
"build_date" : "2023-01-04T09:35:21.782467981Z",
"build_snapshot" : false,
"lucene_version" : "9.4.2",
"minimum_wire_compatibility_version" : "7.17.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "You Know, for Search"
}
* Connection #0 to host ELASTIC-01 left intact
So I changed the elasticsearch.hosts in my kibana.yml to:
elasticsearch.hosts: ['https://ELASTIC-01.zonelocal:9200', 'https://ELASTIC-02.zonelocal:9200', 'https://ELASTIC-03.zonelocal:9200']
Unfortunately Kibana still doesn't connect to elasticsearch with the same error as always:
Jan 11 12:31:12 KND-KIBANA-01 kibana[17711]: [2023-01-11T12:31:12.178+01:00][ERROR][elasticsearch-service] Unable to retrieve version information from Elasticsearch nodes. unable to get issuer certificate
