# SSL using Enterprise CA issued Certificates
**URL:** https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [June 11, 2020, 3:13am UTC](https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608 "2020-06-11T03:13:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@handyd](https://discuss.elastic.co/u/handyd)
#### Post date: [June 11, 2020, 3:13am UTC](https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608/1 "2020-06-11T03:13:36Z")
I'm having trouble configuring transport and HTTP SSL for Elastic Stack in my environment. The environment is Windows 2016 (domain-joined) and everything in the stack works fine. I've enabled x-pack security and followed the instructions [here](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash) for configuring SSL.
This didn't really work as Kibana wouldn't work on HTTPS and when testing Elasticsearch using curl, I had to add --ssl-no-revoke to get Elasticsearch to work, otherwise, I received an error about failing to check the revocation list for the certificate (which I think was causing the Kibana issues as well).
Are there any instructions for configuring SSL in a Windows domain-joined environment using certificates issued by the internal Enterprise CA, which would be preferable than the self-generated certificates, or any workaround for the certificate revocation error issue?
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 11, 2020, 4:41am UTC](https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608/2 "2020-06-11T04:41:49Z")
> [@handyd](#):
>
> This didn't really work as Kibana wouldn't work on HTTPS
Can you give us more information ? What was the error, what was printed in the logs ?
> [@handyd](#):
>
> This didn't really work as Kibana wouldn't work on HTTPS and when testing Elasticsearch using curl, I had to add --ssl-no-revoke to get Elasticsearch to work
You actually had to use `--ssl-no-revoke` to get `curl` to work. If I get this right, Elasticsearch "works" fine, but it's curl that fails to connect to it because it can check the revocation status of the certificate that your internal Enterprise CA has issued.
> [@handyd](#):
>
> or any workaround for the certificate revocation error issue?
I'm afraid I can't think of something. Have you talked to your AD admin about the issue ? It sounds like your machine isn't configured to consume or can't connect to your CAs CRLs.
---
### Author:  [@handyd](https://discuss.elastic.co/u/handyd)
#### Post date: [June 14, 2020, 11:27pm UTC](https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608/3 "2020-06-14T23:27:53Z")
> You actually had to use `--ssl-no-revoke` to get `curl` to work. If I get this right, Elasticsearch "works" fine, but it's curl that fails to connect to it because it can check the revocation status of the certificate that your internal Enterprise CA has issued.
This is correct, but the certificate isn't issued by the Enterprise CA, its the one generated by the elasticsearch-certutil utility.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 15, 2020, 1:00pm UTC](https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608/4 "2020-06-15T13:00:44Z")
> [@handyd](#):
>
> This is correct, but the certificate isn't issued by the Enterprise CA, its the one generated by the elasticsearch-certutil utility.
Gotcha! you said
> in a Windows domain-joined environment using certificates issued by the internal Enterprise CA
which seemed to indicate otherwise.
I see two options:
1. You keep using the certficates you have now ( generated with `elasticsearch-certutil` ) and you speak to your AD admin about how you can add them to the CRL lists your domain is using.
2. a. You get your AD to issue a sub-CA for your internal CA and have that subCA sign all the certificates that you will then use for the transport layer in your nodes. You **need to make sure** that this subCA will only issue certificates for your nodes though.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2020, 1:00pm UTC](https://discuss.elastic.co/t/ssl-using-enterprise-ca-issued-certificates/236608/5 "2020-07-13T13:00:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.