# \[Solved\] Elasticsearch integration metric settings (elastic-agetnt) **URL:** \ **Category:** Elastic Agent\ **Tags:** elastic-stack-monitoring, elastic-stack-security\ **Created:** [August 15, 2024, 8:41pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984 "2024-08-15T20:41:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Abdarrahmane](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Post date:** [August 15, 2024, 8:41pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984/1 "2024-08-15T20:41:14Z")
hello everyone, I have installed the elastic agent (enrolled in fleet) in all the nodes in my elasticsearch cluster they all have these settings ```auto # Enable security features xpack.security.enabled: true xpack.security.enrollment.enabled: true # Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12 # Enable encryption and mutual authentication between cluster nodes xpack.security.transport.ssl: enabled: true verification_mode: certificate client_authentication: required keystore.path: certs/elastic-certificates.p12 truststore.path: certs/elastic-certificates.p12 ``` all the agents installed in all the nodes of my cluster are enrolled in fleet under the same policy named "elasticsearch\_clusterz\_nodes" in this policy I added elasticsearch integration to monitor and view logs and metrics of every node ![Capture d'écran 2024-08-15 212345](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0ac870370fdcf2a63b5af57c4ebc75a7187391eb.png) but the problem is that I get this error in all nodes (under stack monitoring) ![Capture d'écran 2024-08-15 205945](https://us1.discourse-cdn.com/elastic/original/3X/0/4/0456ed3d4368155abebd5ca0d51cd9ccf5a65313.png) i suspected these settings the username and password are correct but i don't know wich cert or api key i should use ![Capture d'écran 2024-08-16 002439](https://us1.discourse-cdn.com/elastic/original/3X/3/2/32930f42adc7976b67b5b5ef126896e57b6343b9.png) for the certs that i already have are: the certificate used for communication with the cluster `elasticsearch-ca.pem` ssl certificate of each node `http.p12` i converted my CA (elastic-stack-ca.p12) using these command two commands ```auto openssl pkcs12 -in elastic-stack-ca.p12 -out cert.crt -clcerts -nokeys openssl pkcs12 -in elastic-stack-ca.p12 -out private.key -nocerts -nodes ``` to get `cert.crt` and `private.key` of the certification used to communicate with the cluster but it didn't work sadly same thing with my `http.p12` SSL of each node I converted it using these commands to get `http.crt` and `http.key` but sadly it didn't work either ```auto openssl pkcs12 -in http.p12 -clcerts -nokeys -out http.crt openssl pkcs12 -in http.p12 -nocerts -out http.key -nodes ``` ![Capture d'écran 2024-08-16 002450](https://us1.discourse-cdn.com/elastic/original/3X/2/0/209d207adabaea5b0c8602859625bba0ce72c873.png) please help @stephenb ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 16, 2024, 4:26pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984/2 "2024-08-16T16:26:32Z")
Hi @Abdarrahmane First, please do not directly mention / ping people such as myself who are not already part of your conversation; it is not forum best practice. Thanks for the details. Can you post the text version of the SSL settings? We can not do much with screenshots. have you simply tried to go to the box you installed the agent and try to curl the cluster `curl -v --cacert /path/to/ca -u elastic https://localhost:9200` Try that and come back show the command and the complete result in text Also you should only need the `certificate_authorities` not the 2 other settings The settings descriptions are [here](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html#ssl-client-config) from the line You can also try `verification_mode: none` just to test... but in the end if the curl does not work the integration will not. ---
**Author:** ![Abdarrahmane](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Post date:** [August 16, 2024, 7:13pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984/3 "2024-08-16T19:13:27Z")
hello stephen Thank you for taking the time to answer me as always my apologies I'm quite new to the community, I didn't know the rules 😅😅 I went into one of the nodes and run the command: ```auto curl -v --cacert /etc/elasticsearch/certs/elasticsearch-ca.pem -u elastic https://localhost:9200 ``` and here is its output: ```auto root@elasticsearch1:/home/elasticsearch1# curl -v --cacert /etc/elasticsearch/certs/elasticsearch-ca.pem -u elastic https://localhost:9200 Enter host password for user 'elastic': * Trying 127.0.0.1:9200... * TCP_NODELAY set * Connected to localhost (127.0.0.1) port 9200 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/elasticsearch/certs/elasticsearch-ca.pem CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN, server did not agree to a protocol * Server certificate: * subject: CN=node-1 * start date: Jul 31 17:19:11 2024 GMT * expire date: Jul 31 17:19:11 2029 GMT * subjectAltName does not match localhost * SSL: no alternative certificate subject name matches target host name 'localhost' * Closing connection 0 * TLSv1.3 (OUT), TLS alert, close notify (256): curl: (60) SSL: no alternative certificate subject name matches target host name 'localhost' More details here: https://curl.haxx.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. ``` I think its because the SSL certificate used by Elasticsearch does not have `localhost` listed as a valid `subjectAltName` (SAN). when I Bypass the Certificate Validation using this command ```auto curl -v -k -u elastic https://localhost:9200 ``` it works same this for the integration when I added `verification_mode: none` in the SSL configuration of the integration but this is not recommended for production environments, therefore are there other solutions like regenerating the certificate with `localhost` in SAN for each node certification as explained in here: [Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide [8.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.15/security-basic-setup-https.html) or any other solution that ensures security ? thank you! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 16, 2024, 8:34pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984/4 "2024-08-16T20:34:41Z")
Yup regenerate the certs with the proper SANs, IPs etc... test with `curl` and you should be good to go. That is the proper secure approach ---
**Author:** ![Abdarrahmane](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Post date:** [August 16, 2024, 8:55pm UTC](https://discuss.elastic.co/t/solved-elasticsearch-integration-metric-settings-elastic-agetnt/364984/5 "2024-08-16T20:55:59Z")
Done, And it worked !! Thank you so much stephen have a good one !