# SSL using X-pack : Invalid security certificate **URL:** \ **Category:** Elasticsearch\ **Created:** [February 27, 2017, 2:47pm UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639 "2017-02-27T14:47:20Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Post date:** [February 27, 2017, 2:47pm UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/1 "2017-02-27T14:47:20Z")
Hi, I successfully configured ssl on my cluster. However when I open the url in firefox I get a big warning. ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5302421b21285b439476d3a5d3dd218fbb1c865a.jpg) Is there any way I can change the certificate generation to make this warning go away? PS: I did not provide the DNS name when generating certificates. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [February 27, 2017, 7:22pm UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/2 "2017-02-27T19:22:11Z")
Hey @pk.241011 how did you go about generating the certificate? You'll want the domain name of the certificate to match the domain name of the URL that you're using to access Kibana. If you purchased a SSL certificate for a public domain name, you'll want to access Kibana using the public domain-name as opposed to the hostname of the server. ---
**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Post date:** [March 1, 2017, 12:17am UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/3 "2017-03-01T00:17:41Z")
I just followed the steps outlined in the help page on Elastic website. I did not buy any SSL certificate. Here is a sample of the ipconfig from my windows machine. ``` Windows IP Configuration Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : corp.StarkIndustries.org Link-local IPv6 Address . . . . . : G::G:G:G:GGG IPv4 Address. . . . . . . . . . . : XXX.XXX.XXX.XXX Subnet Mask . . . . . . . . . . . : YYY.YYY.YYY.YYY Default Gateway . . . . . . . . . : ZZZ.ZZZ.ZZZ.ZZZ Ethernet adapter VirtualBox Host-Only Network: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : F::F:F:F:FFF Autoconfiguration IPv4 Address. . : MMM.MMM.MMM.MMM Subnet Mask . . . . . . . . . . . : TTT.TTT.TTT.TTT Default Gateway . . . . . . . . . : Tunnel adapter isatap.corp.StarkIndustries.org: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : corp.StarkIndustries.org Tunnel adapter isatap.{...blah...}: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : ``` Lest us assume that my computer name is **"Alpha"** and the Full computer name is **"[Alpha.corp.StarkIndustries.org](http://Alpha.corp.StarkIndustries.org)"** Can someone point out given this what should I be putting in : Enter instance name: Enter IP Addresses for instance (comma-separated if more than one) []: Enter DNS names for instance (comma-separated if more than one) []: ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [March 1, 2017, 8:37pm UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/4 "2017-03-01T20:37:47Z")
@pk.241011 it all depends on the domain-name, or ip address that you're using to access Kibana. If you're accessing Kibana on the following url [https://localhost](https://localhost) you'll want to use `localhost` for the `Enter DNS names for instance`. Or if you're using https:/Alpha.corp.StarkIndustries.org, you'll want to use `Alpha.copr.StarkIndustries.org` ---
**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Post date:** [March 2, 2017, 5:24am UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/5 "2017-03-02T05:24:51Z")
I tried by giving just the `alpha` to the DNS field. I guess port number is not needed. Still getting same error. ![](https://us1.discourse-cdn.com/elastic/original/2X/2/2eb9e94ab411f27008b2a3721029e85a290f034e.jpg) Is Elastic Certificate Tool Autogenerated CA trusted by default by the browsers or do I have to add exceptions (since it is self signed) to browsers to make warning go away? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 2, 2017, 6:11am UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/6 "2017-03-02T06:11:24Z")
> [@pk.241011](#): > > Is Elastic Certificate Tool Autogenerated CA trusted by default by the browsers No, that would be a major security problem - the tool allows you to generate certificates for all sorts of hostnames. If the browsers trusted them by default, that would break the whole certificate trust model that is used on the internet. If you use the `certgen` tool in its [default mode](https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html#generating-signed-certificates) (i.e. If you don't use the `-csr` option) then the certificates that you get will not be automatically trusted by the browser. You have three broad options: 1. Accept that it's a self-signed certificate and add an exception in your browser. **Note** You need to decide for yourself whether this is a good idea or not. If you are the only one using the site, then this _might_ be a good option, but if you are asking other people to login to Kibana, then training them to "just add an exception" might not be a good idea. This decision is one that depends on context, and we aren't able to advise you as to whether it is suitable in your situation. 2. Add the auto-generated CA as a trusted issuer in your browser. **Note** There are security implications if you do this, and as with the previous option, we can't tell you whether it's a good idea or not. You should make sure you understand the implications of this before you go down that path. 3. Use a trusted CA (commercial or organisational to sign your certificate. The `certgen` documentation has [instructions for that](https://www.elastic.co/guide/en/x-pack/current/ssl-tls.html#generating-csr). Depending on your circumstances there may be a financial cost, and it may require that you are the owner/admin of your domain. We have an article on our blog about [how to use Let's Encrypt certificates](https://www.elastic.co/blog/x-pack-security-for-elasticsearch-with-lets-encrypt-certificates) in Elasticsearch and Kibana. That may be helpful to you. ---
**Author:** ![pk.241011](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pk.241011/32/86285_2.png) [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Post date:** [March 4, 2017, 9:24pm UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/7 "2017-03-04T21:24:53Z")
Thanks for clarification Tim. Maybe this elaboration is something which can be added as a side note to the documentation. Will help newbies like me. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 1, 2017, 9:25pm UTC](https://discuss.elastic.co/t/ssl-using-x-pack-invalid-security-certificate/76639/8 "2017-04-01T21:25:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.