Self-managed and air-gapped cluster: How to bypass self-signed certificate validation or configure custom endpoints in kibana.yml?

Elastic Stack Kibana
1

Hi everyone,

I manage a self-managed, completely air-gapped Elastic cluster in an isolated network environment with no internet access.

In our corporate infrastructure, we have an internal ERP and EMS running with self-signed SSL certificates, but we do not have access to the original root Certificate Authority (CA) chain that signed them.

When trying to integrate or point services in this environment, I am running into certificate validation errors (such as x509: certificate signed by unknown authority).

Could you please clarify:

  1. What specific configuration parameter(s) should I add in kibana.yml to skip or ignore SSL certificate verification for these components?

  2. Alternatively, how can I properly instruct the platform to trust these custom endpoints/IP addresses without the full CA chain?

Any examples or snippets of the required settings in kibana.yml would be greatly appreciated.

Thanks in advance for your help!

2

Hi @Osmel_Pillot_Leyva

I have meeaning to get to this for a couple days.

1st Elastic really does very little "special" with respect to SSL / TLS Certificates and Validation so all this is just normal SSL / Trust stuff.

And in general..... Air-Gap or Not

Not having access to the Root CA means Elastic cannot establish normal trust for TLS connections, so certificate verification fails. The Root CA could be available for use in the configs or many organization install the Root CA as part of the host trust store. Sounds like you have neither.

I must admit it is unusual to have an Air Gap and not trust the corp CA.

As a result, you must either:

  • obtain and trust the CA/server certificate, or
  • bypass verification, which reduces security.

What specific configuration parameter(s) should I add in kibana.yml to skip or ignore SSL certificate verification for these components?

Kibana is connecting to Elasticsearch

in kibana.yml Use:

elasticsearch.ssl.verificationMode: none

Possible values are:

  • full = verify chain + hostname
  • certificate = verify chain, but skip hostname verification
  • none = skip all certificate verification

Alternatively, how can I properly instruct the platform to trust these custom endpoints/IP addresses without the full CA chain?

I am not completely clear which platform and which custom endpoints you are referring to...

But as far as I know. You either have the CA to trust or you do not.
There is not magic way to trust certs.
You will need to some equivalent setting SSL verification mode to none

Perhaps some other cert guru can help you.

Hope this helps.

3

This is my configuration, similar situation as you. no Certificate

# cat /etc/kibana/kibana.yml |grep -v ^#
server.port: 5601

server.host: "my-host"
server.name: "my-host"
elasticsearch.hosts: ["http://my-host:9200"]


elasticsearch.username: "kibana_system"
elasticsearch.password: "kibana_system_password"

server.maxPayload: 1548576
server.publicBaseUrl: http://my-host:5601
unifiedSearch.autocomplete.valueSuggestions.timeout: 30000
unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 2000000
xpack.fleet.agents.enabled: false
xpack.fleet.enabled: false
telemetry.enabled: false
xpack.observabilityAIAssistant.enabled: false
monitoring.kibana.collection.enabled: false


xpack.reporting.csv.maxSizeBytes: 104857600
xpack.security.sessionTimeout: 24h
xpack.security.encryptionKey: "some random data for testing here"
xpack.encryptedSavedObjects.encryptionKey: "some random data for testing here"
xpack.reporting.encryptionKey: "some random data for testing here"
xpack.reporting.capture.browser.chromium.disableSandbox: false

Running 8.16.1