# Kibana6.7.0 ssl client connection error **URL:** \ **Category:** Kibana\ **Created:** [April 5, 2019, 2:08am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500 "2019-04-05T02:08:29Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 5, 2019, 2:08am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/1 "2019-04-05T02:08:29Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/5/d/5d46c5e01be855e13f7079a6bf5804ced2a570d7.png) kibana.yml server.host: "IPADDRESS" server.name: "IPADDRESS" xpack.security.enabled: true elasticsearch.username: "kibana" elasticsearch.password: "password" server.ssl.enabled: true server.ssl.certificate: /path/to/certificate/es-demo/es-demo.crt server.ssl.key: /path/to/certificate/es-demo/es-demo.key I tried to create certificate with elasticsearch-certutil, elasticsearch-certgen, but the same error occurs. like this.. $ES\_HOME/bin/elasticsearch-certgen $ES\_HOME/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --pem --ip IPADDRESS --out kibana-cert.zip --ca-dn CN=IPADDRESS What more settings do I need? ---
**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\ **Post date:** [April 5, 2019, 2:48pm UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/2 "2019-04-05T14:48:30Z")
Hey @Yungyoung_Ok, Are you connecting to Elasticsearch over `https`? If so, you need to make sure that certificate is trusted by Kibana. If a custom CA was used for that certificate, then you'll need to set `elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.pem"]` as well. If not, then I have a few more questions: When is this error appearing in the logs? Are there any other errors? Does Kibana function despite these errors, either partially or fully? Is Elasticsearch configured to require a client certificate? ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 8, 2019, 1:13am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/3 "2019-04-08T01:13:01Z")
> **[Elasticsearch Security: Configure TLS/SSL & PKI Authentication](https://www.elastic.co/kr/blog/elasticsearch-security-configure-tls-ssl-pki-authentication)** > > Learn how to enable Elasticsearch security, configure TLS/SSL, use PKI for authentication, authenticate Kibana to an Elasticsearch cluster using PKI, and set passwords for built-in users. Yes, I set elasticsearch.ssl.certificateAuthorities just like the above guide. elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.cer"] With this setting, both the ElasticSearch and Kibana functions well. This error occurs when setting kibana ssl. No other errors will occur. ---
**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\ **Post date:** [April 8, 2019, 12:04pm UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/4 "2019-04-08T12:04:31Z")
Can you set `logging.verbose: true` in your `kibana.yml`, restart Kibana, and post the complete log file? ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 9, 2019, 2:16am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/5 "2019-04-09T02:16:42Z")
Here is kibana log ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/e/fe861b3eb532882887854b29554a1525e16b332f.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/e/8edd911b404cab7f6298886ca6ccb81376ccdd26.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e8fc7700835b24a8de9533564c73998212b786d3.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/9/6973e98cce1ed14938eb0a18950efaa5ce5dedb2.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/f/2f57db1a86d105559725382ea0f96073ca2d4b57.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0dc08ca1f5d3beb812283da22fe1248cf0619fe8.png) ※ The certificate was created using elasticsearch-certutil. ---
**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\ **Post date:** [April 9, 2019, 10:57am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/6 "2019-04-09T10:57:01Z")
Thanks for posting. Nothing else seems out of the ordinary to me here. Is your client (browser) also configured to send a client certificate? We've seen similar errors in the past when the browser tries to send a client certificate, but Kibana isn't expecting one. Which browser are you using to connect to Kibana? ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 10, 2019, 12:55am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/7 "2019-04-10T00:55:28Z")
Browser is chrome and internet explorer11. When working on another server, I have not set anything else in my browser, Is there anything else I need to set up in my browser for certificate authentication? ---
**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\ **Post date:** [April 10, 2019, 11:00am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/8 "2019-04-10T11:00:51Z")
> [@Yungyoung\_Ok](#): > > I have not set anything else in my browser, > Is there anything else I need to set up in my browser for certificate authentication? No. Kibana does not support client certificates at this time, so I wanted to make sure you weren't trying to implement that. I could see that being a potential cause for the SSL errors you are seeing. I'm not sure what else could be the problem here... @Brandon_Kobel sorry for the ping, do you have any thoughts on what I might have missed? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [April 10, 2019, 2:55pm UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/9 "2019-04-10T14:55:14Z")
> [@Larry\_Gregory](#): > > I'm not sure what else could be the problem here... @Brandon_Kobel sorry for the ping, do you have any thoughts on what I might have missed? Nothing jumps out off-hand. Would you mind sharing your full kibana.yml (redacting sensitive information) @Yungyoung_Ok? ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 11, 2019, 2:02am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/10 "2019-04-11T02:02:17Z")
sure. here is kibana.yml server.port: 5615 server.host: "kibana server ip" server.name: "kibana server ip" elasticsearch.hosts: ["elasticsearch server ip:port"] xpack.security.enabled: true elasticsearch.username: "kibana" elasticsearch.password: "password" server.ssl.enabled: true server.ssl.certificate: /path/to/certs/instance/instance.crt server.ssl.key: /path/to/certs/instance/instance.key elasticsearch.ssl.certificateAuthorities: ["/path/to/elasticsearch/certs/client/client-ca.cer"] logging.verbose: true --- here is elasticsearch config --- network.host: elasticsearch server ip http.port: http port transport.port: tcp port discovery.zen.hosts\_provider: file discovery.zen.minimum\_master\_nodes: 1 xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.keystore.path: path/to/certs/oknode-1.p12 xpack.security.transport.ssl.truststore.path: path/to/certs/oknode-1.p12 xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: path/to/certs/oknode-1.p12 xpack.security.http.ssl.truststore.path: path/to/certs/oknode-1.p12 xpack.security.http.ssl.client\_authentication: optional xpack.security.authc.realms.pki1.type: pki ※ All certificates were created using the elasticsearch-certutil command. This is the site I referenced. > **[Elasticsearch Security: Configure TLS/SSL & PKI Authentication](https://www.elastic.co/blog/elasticsearch-security-configure-tls-ssl-pki-authentication)** > > Learn how to enable Elasticsearch security, configure TLS/SSL, use PKI for authentication, authenticate Kibana to an Elasticsearch cluster using PKI, and set passwords for built-in users. ※I also tested with the elasticsearch-certgen command, There was no problem with kibana 6.5.4, but the same problem occurred with kibana 6.7.0. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [April 11, 2019, 1:55pm UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/11 "2019-04-11T13:55:53Z")
Very interesting, nothing pops out from your kibana.yml. Are you seeing these errors logged as soon as you go to Kibana's home-page? ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 12, 2019, 1:14am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/12 "2019-04-12T01:14:07Z")
yes. When i connect with a kibana url, the error immediately occurs. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [April 12, 2019, 3:47pm UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/13 "2019-04-12T15:47:36Z")
Hey @Yungyoung_Ok, when you go to Kibana, are you seeing a warning about the certificate not being trusted, similar to the following: ![04%20AM](https://us1.discourse-cdn.com/elastic/original/3X/d/a/dab66a053afc703f70e753476309bbb79f319e58.png) ![08%20AM](https://us1.discourse-cdn.com/elastic/original/3X/a/5/a5a3f6c783ad63c11d06b86f076da58ff7f0949c.png) ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 15, 2019, 1:30am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/14 "2019-04-15T01:30:38Z")
I have created a certificate with the elasticsearch-certutil command. Should I not use this certificate in a kibana? ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [April 15, 2019, 3:21pm UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/15 "2019-04-15T15:21:25Z")
@Yungyoung_Ok you can definitely use the certificates created by `elasticsearch-certutil` in Kibana. In my testing, I'm seeing this error logged when connecting using a certificate that the browser doesn't trust, and you proceed anyway with the warnings. In this situation, that log message can be ignored, I've created [https://github.com/elastic/kibana/issues/35004](https://github.com/elastic/kibana/issues/35004) to improve the logging experience in these situations. ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [April 16, 2019, 1:20am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/16 "2019-04-16T01:20:40Z")
thanks! ---
**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Post date:** [May 7, 2019, 5:47am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/17 "2019-05-07T05:47:21Z")
If you use the elasticseach-certutil certificate in kibana 6.7, do I have to leave a error message? Can I make it invisible? In addition, the https.ssl setting does not login to additional users, except for users reserved by kibana (ex elastic, kibana). No special logs are left, only called invalid username or password in Kibana. However, the user name and password are clearly correct. Is there any other permission or authentication required for the user to login? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 4, 2019, 5:47am UTC](https://discuss.elastic.co/t/kibana6-7-0-ssl-client-connection-error/175500/18 "2019-06-04T05:47:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.