# TLS Between Elastic & Kibana…Alerts Not Working **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security, elastic-stack-alerting\ **Created:** [March 5, 2021, 12:20pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367 "2021-03-05T12:20:25Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Rok](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@Rok](https://discuss.elastic.co/u/Rok)\ **Post date:** [March 5, 2021, 12:20pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/1 "2021-03-05T12:20:25Z")
Hi. I have established TLS on our cluster (v7.11.1). Entire cluster seems to be working fine except Alerts and Report section. The alerting section in kibana still says " You must enable Transport Layer Security Alerting relies on API keys, which require TLS between Elasticsearch and Kibana. Learn how to enable TLS ." I believe I took all the relevant steps to secure the connection between Kibana and Elasticsearch. Here are the config parameters currently set in my yml files. `kibana.yml:` > server.ssl.enabled: true > server.ssl.certificate: /etc/kibana/certs/Elastic-Kibana-HTTP-1.cer > server.ssl.key: /etc/kibana/certs/Elastic-Kibana-HTTP-1.key > elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/INFRA-RCA\_INFRA-SCA\_chain.pem"] > elasticsearch.ssl.verificationMode: full > xpack.security.encryptionKey: "fK9QUev3GdfVHc31GR1lcyWe7PKanj7o7hdTDZ7W"` > xpack.encryptedSavedObjects.encryptionKey: "8KacgxuuthHBvChtdFuElS5QxPdBUBiS9gSeDcyXj3mDwtUzWe" `elasticsearch.yml:` > xpack.security.enabled: true > xpack.security.transport.ssl.enabled: true > xpack.security.transport.ssl.verification\_mode: full > xpack.security.transport.ssl.key: certs/Elastic-Kibana-1.key > xpack.security.transport.ssl.certificate: certs/Elastic-Kibana-1.cer > xpack.security.transport.ssl.certificate\_authorities: certs/INFRA-RCA\_INFRA-SCA\_chain.pem > xpack.security.http.ssl.enabled: true > xpack.security.http.ssl.key: certs/Elastic-Kibana-1.key > xpack.security.http.ssl.certificate: certs/Elastic-Kibana-1.cer > xpack.security.http.ssl.certificate\_authorities: ["/etc/elasticsearch/certs/INFRA-RCA\_INFRA-SCA\_chain.pem"] > xpack.security.http.ssl.client\_authentication: optional Any suggestions on what am I missing? ---
**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\ **Post date:** [March 9, 2021, 3:22pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/2 "2021-03-09T15:22:54Z")
@Patrick_Mueller can we please get your eyes for a bit? Thanks, Bhavya ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [March 9, 2021, 4:14pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/3 "2021-03-09T16:14:07Z")
Here are the guides we point people to: - [Configure security in Kibana | Kibana Guide [7.11] | Elastic](https://www.elastic.co/guide/en/kibana/current/using-kibana-with-security.html) - [Encrypt communications in Kibana | Kibana Guide [7.11] | Elastic](https://www.elastic.co/guide/en/kibana/current/configuring-tls.html#configuring-tls-kib-es) As far as I know these are complete, and if they aren't, we'll have to get someone in security involved, as I'm not sure exactly how all these work together. Most people hitting the TLS warning in Alerting, that are attempting to use TLS, usually end up having a TLS terminator in front of elasticsearch, which is not _currently_ supported (there is an issue in elasticsearch to allow such configurations). That doesn't appear to be the case here, it looks like elasticsearch is being configured to run in TLS mode directly - but again, I'm not an expert here. Some simple things to check: - have Kibana and elasticsearch been restarted? - anything security-related or alert-related in the elasticsearch or Kibana logs? ---
**Author:** ![Rok](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@Rok](https://discuss.elastic.co/u/Rok)\ **Post date:** [March 10, 2021, 1:10pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/4 "2021-03-10T13:10:04Z")
Thank you for your response. I have rechecked the Kibana Guide you mentioned, also folowed the link on how to enable TLS and I didn't find any mistakes in my configuration. Kibana and Elasticsearch have been restarted numerous times. Didn't find any alerts in logs besides deprecation. Do the xpack.security.http.ssl settings have to be configured on all elasticsearch nodes? I have 8 nodes in my cluster, but kibana is only connecting to two, which do have the configuration above. ---
**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\ **Post date:** [March 10, 2021, 7:42pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/5 "2021-03-10T19:42:50Z")
> [@Rok](#): > > Do the xpack.security.http.ssl settings have to be configured on all elasticsearch nodes? > I have 8 nodes in my cluster, but kibana is only connecting to two, which do have the configuration above. Good question, I don't know for sure, but seems like it could be confusing for you in the future to have different settings for different nodes. Did you include the `https` protocol in your `kibana.yml` setting for `elasticsearch.hosts`? I didn't see one in your config above; example from the doc I referenced: `elasticsearch.hosts: ["https://.com:9200"]` There were some additional security related configs referenced in one of the docs I linked to before, that aren't listed in your config above - [Configure security in Kibana | Kibana Guide [8.11] | Elastic](https://www.elastic.co/guide/en/kibana/current/using-kibana-with-security.html) - but I'm guessing you already had security configured, and are just looking at enabling TLS? ---
**Author:** ![bansalhp](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@bansalhp](https://discuss.elastic.co/u/bansalhp)\ **Post date:** [March 14, 2021, 4:05am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/6 "2021-03-14T04:05:29Z")
@Rok Any luck ? I am facing same issue ---
**Author:** ![Rok](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@Rok](https://discuss.elastic.co/u/Rok)\ **Post date:** [March 15, 2021, 6:40am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/7 "2021-03-15T06:40:11Z")
I have kibana installed on the same node where I have the elasticsearch installed with the configuration above. I have different configurations of elasticsearch depending on their roles. 3x master, 3x data and 2x coordinating nodes with kibana. Yes, I have https in my configuration. It is pointing to itself. > elasticsearch.hosts: ["[https://Elastic-Kibana-1:9200](https://Elastic-Kibana-1:9200)"] As you have written I have security already configured and I only have problems with TLS section. From the manul page you mentioned I don't have xpack.security.session values set, but I'm guessing they are irrelevant to what I'm trying to achieve. ---
**Author:** ![Rok](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@Rok](https://discuss.elastic.co/u/Rok)\ **Post date:** [March 15, 2021, 6:43am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/8 "2021-03-15T06:43:38Z")
No, not yet. I'm stuck running in circles. Rechecking the configuration, going through the manual. I even cleared everything starting from scratch. Same result. ☹ ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 15, 2021, 7:43am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/9 "2021-03-15T07:43:25Z")
> [@Rok](#): > > I have different configurations of elasticsearch depending on their roles. > 3x master, 3x data and 2x coordinating nodes with kibana. Do all those nodes have TLS enabled for HTTP? I suspect the problem here is that your elected master node does not. Can you check ```auto GET /_xpack/usage ``` and look at the value for `security.ssl.http.enabled` ? ---
**Author:** ![Rok](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@Rok](https://discuss.elastic.co/u/Rok)\ **Post date:** [March 16, 2021, 11:37am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/10 "2021-03-16T11:37:42Z")
That did the trick. 🙂 Thank you. ---
**Author:** ![bansalhp](https://avatars.discourse-cdn.com/v4/letter/b/f14d63/32.png) [@bansalhp](https://discuss.elastic.co/u/bansalhp)\ **Post date:** [March 23, 2021, 4:20pm UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/11 "2021-03-23T16:20:11Z")
Rok, Please make sure your matricbeat is configured properly at current master node. ---
**Author:** ![serega](https://avatars.discourse-cdn.com/v4/letter/s/53a042/32.png) [@serega](https://discuss.elastic.co/u/serega)\ **Post date:** [March 24, 2021, 11:03am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/13 "2021-03-24T11:03:05Z")
Good afternoon. And can you send the settings of these 2 yml files (without keys, instead of keys put....)? how did you set up the certificates (I haven't been able to do it for 4 days) ? [sergmartynenko1986@yandex.ru](mailto:sergmartynenko1986@yandex.ru) ---
**Author:** ![Rok](https://avatars.discourse-cdn.com/v4/letter/r/d2c977/32.png) [@Rok](https://discuss.elastic.co/u/Rok)\ **Post date:** [April 9, 2021, 7:05am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/14 "2021-04-09T07:05:47Z")
YML files are at the beginning of the post. All elasticsearch nodes have to have TLS enabled for HTTP. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 7, 2021, 7:05am UTC](https://discuss.elastic.co/t/tls-between-elastic-kibana-alerts-not-working/266367/15 "2021-05-07T07:05:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.