# Trouble enabling SSL on Kibana
**URL:** https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383
**Category:** Kibana
**Created:** [May 2, 2019, 2:15pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383 "2019-05-02T14:15:40Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@S\_Chase](https://discuss.elastic.co/u/S_Chase)
#### Post date: [May 2, 2019, 2:15pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383/1 "2019-05-02T14:15:40Z")
RHEL7 Elastic Stack 6.7.1 Not using X-Pack. (following [this guide](https://www.elastic.co/guide/en/kibana/6.7/configuring-tls.html))
I'm having trouble configuring SSL on Kibana over 5601. First I generated a key and then I generated a CSR and sent it to the CA. I retrieved the cert and have two available certs. Base 64 encoded and Base 64 encoded with CA certificate chain in pkcs7 format.
I retrieved both, put the Base64 in a mycert.cer file, put the pcks7 one in a mycert.p7b file. Converted the pcks7 into pem with
`openssl pkcs7 -print_certs -in /etc/kibana/certs/mycert.p7b -out /etc/kibana/certs/mycert.pem`
I put/made sure that .key, .cer and .pem were in the /etc/kibana/cert folder and changed ownership:group to kibana.
in kibana.yml I put
```auto
server.ssl.enabled: true
server.ssl.certificate:/etc/kibana/certs/mycert.cer
server.ssl.key: /etc/kibana/certs/mycert.key
elasticsearch.ssl.certificate: /etc/kibana/certs/mycert.pem
```
Originally i created the CSR with a CN of
```auto
myhost.mydomain.tld
```
then after it failed i created one with
```auto
https://myhost.mydomain.tld:5601
```
When I try to start Kibana i get an error message of:
```auto
digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
```
In trying to search on the subject I see that it can be caused by incompatible OpenSSL versions - but i'm on the same system so that seems unlikely.
--update--
to add to this, i created a self-signed ca and cert to use and it worked fine. When I compare the self-signed ca-cert to the PKCS7 one it's quite a bit different, the PEM converted PKCS7 contains the system cert, and all intermediate ones.
---
### Author:  [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [May 2, 2019, 5:48pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383/2 "2019-05-02T17:48:17Z")
Based on you're update I am not quite sure if you got this working or are still looking for assistance.
---
### Author:  [@S\_Chase](https://discuss.elastic.co/u/S_Chase)
#### Post date: [May 2, 2019, 5:55pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383/3 "2019-05-02T17:55:19Z")
at the update I did, but since then i solved it.
I believe the error part was I didn't have the -ext properly set.
I recreated the Key and CSR (my CA must love me) [following this strictly](https://www.elastic.co/guide/en/shield/shield-1.0/generate-csr.html)
```auto
keytool -genkey \
-alias node01 \
-keystore node01.jks \
-keyalg RSA \
-keysize 2048 \
-validity 712 \
-ext san=dns:node01.example.com,ip:192.168.1.1
```
then the CSR with this.
```auto
keytool -certreq \
-alias node01 \
-keystore node01.jks \
-file node01.csr \
-keyalg rsa \
-ext san=dns:node01.example.com,ip:192.168.1.1
```
I made sure this time to use the -ext option (docs say it's optional) and made darn sure that the alias and the ext were exact. I didn't use the keystore and it just installed it locally.
Then I saved the Key, the base64 Certificate, the PKCS7 version locally - converted the PKCS7 to PEM and set my Kibana to look for the crt, key and the pem.
---
### Author:  [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [May 2, 2019, 6:00pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383/4 "2019-05-02T18:00:25Z")
Great to hear, thanks for the update.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 30, 2019, 6:00pm UTC](https://discuss.elastic.co/t/trouble-enabling-ssl-on-kibana/179383/5 "2019-05-30T18:00:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.