# \[SOLVED\] Kibana 5.3.0 and SSL for browser requests
**URL:** https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051
**Category:** Kibana
**Created:** [May 9, 2017, 9:16am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051 "2017-05-09T09:16:46Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 9, 2017, 9:16am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/1 "2017-05-09T09:16:46Z")
Hello,
Trying to set up SSL connection between browser and kibana does not
work. When activate required parameter server.ssl.certificate and
server.ssl.key in kibana.yml, kibana crashed at startup with any logs.
Certificates have been created with openssl and copied into the configured directories
kibana.yml ssl parameters
server.ssl.enabled: true
server.ssl.certificate: /etc/ssl/certs/kibana.pem
server.ssl.key: /etc/ssl/private/kibana\_key.pem
Generation of certificate:
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 1826 -key ca.key -out ca.crt
openssl genrsa -out kibana\_key.pem 4096
openssl req -new -key kibana\_key.pem -out kibana.csr
openssl req -new -key kibana\_key.pem -out kibana.csr
openssl x509 -req -days 730 -in kibana.csr -CA ca.crt -CAkey ca.key -set\_serial 01 -out kibana.pem
Best regards,
Nico
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 9, 2017, 10:58am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/2 "2017-05-09T10:58:26Z")
Hi @nicocolt,
could you try setting `logging.verbose: true` in the configuration and check if you receive any log output that might give a hint?
---
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 9, 2017, 12:47pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/3 "2017-05-09T12:47:00Z")
Hi @weltenwort ,
Thanks for your quick answer.
Setting `logging.verbose: true` gives absolutely no log. Seems kibana crashed before initiate log system.
Let me know,
Best regards,
Nico
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 9, 2017, 12:57pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/4 "2017-05-09T12:57:16Z")
But it starts up normally when you remove the three ssl configuration parameters you mentioned?
Does the user the Kibana server runs as have read access to the certificate files?
---
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 9, 2017, 1:00pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/5 "2017-05-09T13:00:53Z")
Absolutely right, the server starts normally when those two parameters are commented out. Also, the certificate and the key are owned by the kibana user with these permissions: `rw-r--r--`
Best regards,
Nico
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 9, 2017, 2:51pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/6 "2017-05-09T14:51:53Z")
Ok, that sounds reasonable. Can you give some detail about the operating system, the way Kibana was installed and how it is started? Are you using the tar.gz, the rpm or the deb? What is the init system used by your OS?
---
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 9, 2017, 3:12pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/7 "2017-05-09T15:12:05Z")
I use kibana 5.3.0 with docker image from here: [https://github.com/spujadas/elkx-docker](https://github.com/spujadas/elkx-docker) (which is an image that contains an ELK stack on 5.3 with x-pack 5.3). Note that the issue is exactly the same without x-pack.
So kibana is installed from tar.gz: `kibana-5.3.0-linux-x86_64.tar.gz` and the service is started with `service kibana start`
What type of other information will be useful for you ?
Let me know,
Best regards,
Nico.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 9, 2017, 5:58pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/8 "2017-05-09T17:58:33Z")
The unofficial docker image you're using is quite difficult to debug. On first sight I would say that it does not properly capture the stdout and stderr of the Kibana process, which is where fatal errors during startup might show up. You might be able to get a glance at the error message by running only Kibana as in:
```
$ docker run --rm sebp/elkx:530 /opt/kibana/bin/kibana
```
You probably have to modify this to include your mounted config files and environment variables.
---
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 10, 2017, 9:44am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/9 "2017-05-10T09:44:56Z")
Hi @weltenwort,
Thanks for this update. Found the issue. There was a passphrase in the private key.
But now, if I start kibana by `service kibana start`, it fails, but if i start kibana with `/opt/kibana/bin/kibana`, it works
If I comment out the three parameters, then it works. So I don't understand why it does not works with `service kibana start` when ssl is activated
Let me know,
Best regards,
Nico
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 10, 2017, 9:53am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/10 "2017-05-10T09:53:07Z")
Good to hear you are making progress. Looks like the init script starts Kibana as the `kibana` user. If you mount your certificates into the container, make sure their owner maps to the correct `kibana` user inside the container. The `docker run` line I proposed runs it as root, which is why no permission problems will become apparent there.
---
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 10, 2017, 10:04am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/11 "2017-05-10T10:04:56Z")
You're right, init script is starting with kibana user.
Does kibana user be in a specific group ? Because chown the certificate and the keys to kibana:kibana, does not resolve the issue.
Best regards,
Nico
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 10, 2017, 10:15am UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/12 "2017-05-10T10:15:53Z")
The [init script](https://github.com/spujadas/elk-docker/blob/master/kibana-init#L25-L26) looks like it runs it as `kibana:kibana`. Maybe run
```
$ docker run --rm ${YOUR_MOUNTS} -i -t sebp/elkx:530 bash
```
to interactively inspect the container and check that the files really have the correct permissions. Then try running
```
$ docker run --rm ${YOUR_MOUNTS} --user kibana:kibana sebp/elkx:530 /opt/kibana/bin/kibana
```
to see if Kibana starts when run as that user.
---
### Author:  [@nicocolt](https://discuss.elastic.co/u/nicocolt)
#### Post date: [May 10, 2017, 12:21pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/13 "2017-05-10T12:21:54Z")
Got it @weltenwort !
It was a permission issue at the directory path containing the certificate. Just move the cert and key to a directory belonging to kibana user solves the problem.
Thanks a lot for your clarification and help !
Best regards,
Nico
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [May 10, 2017, 12:27pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/14 "2017-05-10T12:27:14Z")
Good to know, thanks for letting us know what the reason was. 👍
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 7, 2017, 12:39pm UTC](https://discuss.elastic.co/t/solved-kibana-5-3-0-and-ssl-for-browser-requests/85051/15 "2017-06-07T12:39:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.