Unable to connect Kibana to Elasticsearch

Elastic Stack Elasticsearch
1

Hi there,

I am having an ES cluster running with the following config, with self signed certificates:-

sudo docker run -it --privileged -p 9200:9200 -p 9300:9300 -e discovery.type=multi-node -e "cluster.name=my-elasticsearch-cluster" -e node.name="node-1" -e discovery.seed_hosts=["192.168.1.38:9300","192.168.1.38:8300"] -e network.host="0.0.0.0" -e node.roles=["master","data","ingest"] -e cluster.initial_master_nodes=["node-1","node-2","node-3"] -e network.publish_host="192.168.1.38" -e ELASTIC_PASSWORD=elastic -e xpack.ml.enabled=false -e ES_JAVA_OPTS="-Xms1g -Xmx1g" -e xpack.security.transport.ssl.key=/usr/share/elasticsearch/config/certificates/key.pem -e xpack.security.transport.ssl.certificate=/usr/share/elasticsearch/config/certificates/cert.pem -e xpack.security.transport.ssl.enabled=true -e xpack.security.transport.ssl.verification_mode=certificate -e xpack.security.transport.ssl.certificate_authorities=/usr/share/elasticsearch/config/certificates/CA.pem -e xpack.security.enrollment.enabled=false -e xpack.security.autoconfiguration.enabled=false -v /home/certs:/usr/share/elasticsearch/config/certificates -e xpack.security.http.ssl.enabled=true -e xpack.http.ssl.verification_mode=none -e xpack.security.http.ssl.certificate_authorities=/usr/share/elasticsearch/config/certificates/CA.pem -e xpack.security.http.ssl.key=/usr/share/elasticsearch/config/certificates/key.pem -e xpack.security.http.ssl.certificate=/usr/share/elasticsearch/config/certificates/cert.pem -e xpack.security.http.ssl.client_authentication=none -e xpack.security.enrollment.enabled=false -e xpack.security.autoconfiguration.enabled=false elasticsearch:8.7.0

And Here is the kibana config:-

sudo docker run -p 5601:5601 -e ELASTICSEARCH.SSL.CERTIFICATEAUTHORITIES=/usr/share/kibana/config/certs/CA.pem -e ELASTICSEARCH.SSL.VERIFICATIONMODE=none -e ELASTICSEARCH.SSL.CERTIFICATE=/usr/share/kibana/config/certs/cert.pem -e ELASTICSEARCH.SSL.KEY=/usr/share/kibana/config/certs/key.pem -v /home/certs:/usr/share/kibana/config/certs -e SERVER_SSL_ENABLED=true -e SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/certs/cert.pem -e SERVER_SSL_KEY=/usr/share/kibana/config/certs/key.pem -e SERVER_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/certs/CA.pem -e SERVER.SSL.VERIFICATIONMODE=none docker.elastic.co/kibana/kibana:8.7.0

I am using the the same set of certificates in bot ES server and client.
I am trying to connect to the ES cluster manually and without the hostname verification for now.
But still getting the error:-

[2023-08-25T04:57:44.444+00:00][ERROR][plugins.interactiveSetup.elasticsearch] Failed to authenticate with host "https://192.168.1.38:9200": unable to verify the first certificate
[2023-08-25T04:58:01.635+00:00][INFO ][plugins-system.preboot] Stopping all plugins.

Kindly help me here.
Thanks in advance!

2

Do you have access to your kibana.yml file? Can you send paste the content here. And please ensure that those elasticsearch ssl certificate if the one you used in your elasticsearch nodes. Because I can see that your are pointing the elasticsearch ssl certs to your /usr/share/kibana... make sure the certs on that path for elasticsearch is actually the elasticsearch certs.

3

I entered inside the docker container and here is the kibana.yml file:-

kibana@b49d5114c916:~/config$ cat kibana.yml
THIS IS AN AUTO-GENERATED FILE
Default Kibana configuration for docker target
server.host: "0.0.0.0"
server.shutdownTimeout: "5s"
elasticsearch.hosts: [ "http://elasticsearch:9200" ]
monitoring.ui.container.elasticsearch.enabled: truekibana

It does not reflect the settings am passing as docker run, which I assume is expected behaviour.

I am using same set of certs in ELASTICSEARCH and KIBANA.
What do you mean by:-

Because I can see that your are pointing the elasticsearch ssl certs to your /usr/share/kibana... make sure the certs on that path for elasticsearch is actually the elasticsearch certs.

Shouldn't It be /usr/share/kibana...
If not , do let me know what is the correct path.

Thanks in advance!

4

The reason why kibana.yml file is not reflecting the settings you are passing in your docker run is because the docker run is overriding the settings in the kibana.yml file. Docker will always take precedence over the settings in the kibana.yml file.

This is what you are currently doing, for example.
sudo docker run -p 5601:5601 -e
ELASTICSEARCH.SSL.CERTIFICATEAUTHORITIES=/usr/share/kibana/config/certs/CA.pem

is the elasticsearch CA in this path /usr/share/kibana/config/certs/CA.pem ? If you are using a self signed, this is going to be different from the Kibana's CA. So make sure you are using the CA for elasticsearch in the path.

And also, try doing this..
sudo docker run -p 5601:5601 -e
SERVER_SSL_ENABLED=true -e SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/certs/cert.pem -e SERVER_SSL_KEY=/usr/share/kibana/config/certs/key.pem -e SERVER_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/certs/CA.pem -e SERVER.SSL.VERIFICATIONMODE=none docker.elastic.co/kibana/kibana:8.7.0

Why version 8.7.0?

You can also do

sudo docker run --name kibana --net PUTYOURNETWORKHERE -p 5601:5601 -e
SERVER_SSL_ENABLED=true -e SERVER_SSL_CERTIFICATE=/usr/share/kibana/config/certs/cert.pem -e SERVER_SSL_KEY=/usr/share/kibana/config/certs/key.pem -e SERVER_SSL_CERTIFICATEAUTHORITIES=/usr/share/kibana/config/certs/CA.pem -e SERVER.SSL.VERIFICATIONMODE=none docker.elastic.co/kibana/kibana:8.7.0

Oh lastly,

Make sure you connect kibana to the same network on which Elasticsearch is running.

5

Thanks for the detailed response!

I did the same but still getting:-

[2023-08-25T11:44:31.170+00:00][ERROR][plugins.interactiveSetup.elasticsearch] Failed to authenticate with host "https://192.168.1.38:9200": unable to verify the first certificate

Also, why are you asking about 8.7.0?
Is there anything in 8.7.0 which I should be concerned with?

And, If I want to connect to the ES server running in some other network and kibana in some other network, Can't I connect to it manually?

6

This is an easy fix. So, lets start with the structure of your certs. Are you using a self-signed cert?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.