No living connections - "Unable to get local issuer certificate"

Elastic Stack Kibana
4

The solution is:

  • Elasticsearch must use self-signed certificates (and CA) for both http options (api) and transport options (communication in the cluster). Generate this with the elasticsearch cert utility --dns elasticsearch.
  • Kibana must also use this self-signed certificate to talk to https://elasticsearch for ELASTICSEARCH_SSL vars.
  • Kibana http can use wildcard domain certs for the SERVER_SSL options, so https://kibana.mydomain.com works.

Now kibana can resolve https://elasticsearch because it's using the self-signed cert and can use verification mode full because of the --dns option.

As a result, the elasticsearch API can now only be private because it uses a self-signed cert (no valid https://elasticsearch.mydomain.com).

I'm okay with this, as I don't want elasticsearch publicly accessible on a domain name, but I can imagine it's a downside for others.

2 Likes