# PKI authentication for Kibana **URL:** \ **Category:** Kibana\ **Created:** [May 25, 2016, 1:53pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943 "2016-05-25T13:53:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ChrisR](https://avatars.discourse-cdn.com/v4/letter/c/ecd19e/32.png) [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Post date:** [May 25, 2016, 1:53pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/1 "2016-05-25T13:53:57Z")
I set up PKI authentication on elasticsearch, which is working fine. Client auth is required for all http and transport access to the elasticsearch cluster from browsers, logstash, kibana and other elasticsearch nodes. However, I don't see how to require PKI client authentication to access Kibana from a browser. Is PKI authentication to Kibana supported and documented somewhere? ---
**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\ **Post date:** [May 25, 2016, 11:22pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/2 "2016-05-25T23:22:40Z")
Is this what you are experiencing? [https://github.com/elastic/kibana/issues/6119](https://github.com/elastic/kibana/issues/6119) ---
**Author:** ![ChrisR](https://avatars.discourse-cdn.com/v4/letter/c/ecd19e/32.png) [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Post date:** [May 25, 2016, 11:59pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/3 "2016-05-25T23:59:36Z")
Seems related maybe, but I'm not really sure what the other ticket is asking for exactly. I need the users to authenticate using PKI when connecting to Kibana via a browser. I suspect this is a common requirement for government customers. We have a customer looking to buy x-pack now, but they want users authenticating using PKI. They probably won't care as much about the servers using PKI to authenticate with each other. ---
**Author:** ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)\ **Post date:** [May 26, 2016, 12:42am UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/4 "2016-05-26T00:42:53Z")
Per that ticket, it doesn't appear PKI authentication is fully supported within Kibana without including the kibana\_server credentials in the kibana.yml, which obviously isn't ideal. It might be possible to put Kibana behind a proxy like Nginx which could augment the certificate with basic auth. ---
**Author:** ![ChrisR](https://avatars.discourse-cdn.com/v4/letter/c/ecd19e/32.png) [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Post date:** [May 26, 2016, 1:48am UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/5 "2016-05-26T01:48:31Z")
Even if the kibana\_server credentials are included in the kibana.yml, we will still need to use a reverse proxy to implement PKI user authentication, correct? This is what I'm seeing in my test. There is a comment in the Kibana.yml file that says "Your Kibana users still need to authenticate with Elasticsearch, which is proxied through the Kibana server." I have elasticsearch setup to handle PKI auth, and it works well when connecting from a browser directly into elasticsearch's 9200 port. But when I try to authenticate through Kibana's 5601 port, it will not accept PKI auth, but insists on user/password. Is there any way to require PKI user authentication for Kibana users without using a proxy? ---
**Author:** ![ChrisR](https://avatars.discourse-cdn.com/v4/letter/c/ecd19e/32.png) [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Post date:** [October 15, 2016, 9:08pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/6 "2016-10-15T21:08:30Z")
If DoD were to use ELK as an enterprise solution, Kibana would have to first support PKI authentication. Seems like this would be a worthwhile feature to build into Kibana so that custom solutions do not have to be added to each instance. [http://www.dtic.mil/whs/directives/corres/pdf/852002p.pdf](http://www.dtic.mil/whs/directives/corres/pdf/852002p.pdf) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:36pm UTC](https://discuss.elastic.co/t/pki-authentication-for-kibana/50943/7 "2017-07-06T13:36:28Z")