SSL Certificates Installing in Elasticsearch

[Sreekanth3 (Sreekanth)]

I want to install SSL certificates in my elastic search and kibana to make them secure.
SSL installation setps link

This link i have followed and when i start elastic search .

When i commented that pki setting in yaml file and this below error got out.

if you see i have given the descriptors size to 65536.

Could any one help me to sort out this thing ?

[ikakavas (Ioannis Kakavas)]

Please don't post images of text as they are hard to read, may not display correctly for everyone, and are not searchable.

Instead, paste the text and format it with </> icon or pairs of triple backticks (```), and check the preview window to make sure it's properly formatted before posting it. This makes it more likely that your question will receive a useful answer.

It would be great if you could update your post to solve this.

You should also show us your configuration because if we can't see it, then we can't understand what you have configured wrong and can't offer suggestions.

Regarding file descriptors, see https://www.elastic.co/guide/en/elasticsearch/reference/current/file-descriptors.html.
ulimit -n 65535 is a command you must run, not something you add to a file

[Sreekanth3 (Sreekanth)]

`Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.

[2019-10-24T17:34:40,533][INFO ][o.e.e.NodeEnvironment ] [node-1] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [28.9gb], net total_space [100.5gb], types [rootfs]
[2019-10-24T17:34:40,538][INFO ][o.e.e.NodeEnvironment ] [node-1] heap size [1007.3mb], compressed ordinary object pointers [true]
[2019-10-24T17:34:40,578][INFO ][o.e.n.Node ] [node-1] node name [node-1], node ID [eGYI2ybBRQavgoHq2HwLnQ], cluster name [my-application]
[2019-10-24T17:34:40,579][INFO ][o.e.n.Node ] [node-1] version[7.1.0], pid[7827], build[default/tar/606a173/2019-05-16T00:43:15.323135Z], OS[Linux/3.10.0-327.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/11.0.5/11.0.5+10-LTS]
[2019-10-24T17:34:40,579][INFO ][o.e.n.Node ] [node-1] JVM home [/usr/lib/jvm/jdk-11.0.5]
[2019-10-24T17:34:40,580][INFO ][o.e.n.Node ] [node-1] JVM arguments [-Xms1g, -Xmx1g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=/tmp/elasticsearch-4561765493849782531, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.locale.providers=COMPAT, -Dio.netty.allocator.type=unpooled, -Des.path.home=/opt/ELK/elasticsearch, -Des.path.conf=/opt/ELK/elasticsearch/config, -Des.distribution.flavor=default, -Des.distribution.type=tar, -Des.bundled_jdk=true] [2019-10-24T17:34:41,430][WARN ][o.e.x.c.s.SSLService ] [node-1] Skipping any SSL configuration from realm [xpack.security.authc.realms.pki1] because the key [type] is not in the correct format
[2019-10-24T17:34:43,058][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [main] org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.security.Security] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) ~[elasticsearch-cli-7.1.0.jar:7.1.0] at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.1.0.jar:7.1.0] Caused by: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.security.Security] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:614) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.node.Node.<init>(Node.java:308) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.node.Node.<init>(Node.java:252) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:211) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:211) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:325) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.1.0.jar:7.1.0] ... 6 more Caused by: java.lang.reflect.InvocationTargetException at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:490) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.node.Node.<init>(Node.java:308) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.node.Node.<init>(Node.java:252) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:211) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:211) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:325) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.1.0.jar:7.1.0] ... 6 more Caused by: java.lang.IllegalArgumentException: Incorrect realm settings found. Realm settings have been changed to include the type as part of the setting key. For example 'xpack.security.authc.realms.file.my_file.order' Found invalid config: xpack.security.authc.realms.pki1.type Please see the breaking changes documentation. at org.elasticsearch.xpack.security.Security.validateRealmSettings(Security.java:841) ~[?:?] at org.elasticsearch.xpack.security.Security.runStartupChecks(Security.java:314) ~[?:?] at org.elasticsearch.xpack.security.Security.<init>(Security.java:290) ~[?:?] at org.elasticsearch.xpack.security.Security.<init>(Security.java:281) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?] at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?] at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?] at java.lang.reflect.Constructor.newInstance(Constructor.java:490) ~[?:?] at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.1.0.jar:7.1.0] at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.1.0.jar:7.1.0]

This was the error`

[Yogesh_Gaikwad]

Hi @Sreekanth3,

Looks like the blog post that you are using is old and there are breaking changes with the latest major releases that happened.

I think following is the relevant breaking change for your case:
https://www.elastic.co/guide/en/elasticsearch/reference/current/breaking-changes-7.0.html#include-realm-type-in-setting

It would be good if you can follow the documentation:
https://www.elastic.co/guide/en/elasticsearch/reference/current/ssl-tls.html

Please check the version of the Elasticsearch that you are using and look at the documentation accordingly.

Hope this helps.

Thanks and Regards,
Yogesh Gaikwad