Hello @Yang_Wang ,
Thanks for your answers.
For the transport.ssl certificates I generated from this yml file
instances :
> - name : "node-1"
> ip :
> - "192.168.1.10"
> dns :
> - "elasticsearch-node1.lab.fr"
> - nom : "node-2"
> ip :
> - "192.168.1.20"
> dns :
> - "elasticsearch-node2.lab.fr"
> - nom : "node-3"
> ip :
> - "192.168.1.30"
> dns :
> - "elasticsearch-node3.lab.fr"
> - nom : "node-4"
> ip :
> - "192.168.1.40"
> dns :
> - "elasticsearch-node4.lab.fr"
> - nom : "node-5"
> ip :
> - "192.168.1.50"
> dns :
> - "elasticsearch-node5.lab.fr"
> - nom : "kibana1"
> ip :
> - "192.168.1.80"
> dns :
> - "kibana1.lab.fr"
> - nom : "kibana2"
> ip :
> - "192.168.1.90"
> dns :
> - "kibana2.lab.fr"
> - nom : "logstash1"
> ip :
> - "192.168.1.60"
> dns :
> - "logstash1.lab.fr"
> - nom : "logstash2"
> ip :
> - "192.168.1.70"
> dns :
> - "logstash2.lab.fr"
For http.ssl certificates here is an example of the answer I made to the command
./bin/elasticsearch-certutil http
Generate a CSR? [y/N]N
## Do you have an existing Certificate Authority (CA) key-pair that you wish to use to sign your certificate?
Use an existing CA? [y/N]y
## What is the path to your CA?
CA Path: /usr/share/elasticsearch/elastic-stack-ca.p12
Password for elastic-stack-ca.p12:
## How long should your certificates be valid?
For how long should your certificate be valid? [5y]
## Do you wish to generate one certificate per node?
Generate a certificate per node? [y/N]y
## What is the name of node #1?
node #1 name: node-1
## Which hostnames will be used to connect to node-1?
These hostnames will be added as "DNS" names in the "Subject Alternative Name"
(SAN) field in your certificate.
elasticsearch-node1.lab.fr
You entered the following hostnames.
- elasticsearch-node1.lab.fr
Is this correct [Y/n]y
## Which IP addresses will be used to connect to node-1?
192.168.1.10
You entered the following IP addresses.
- 192.168.1.10
Is this correct [Y/n]y
## Other certificate options
Key Name: node-1
Subject DN: CN=node-1
Key Size: 2048
Is it correct?
elasticsearch.ssl.verificationMode: full
normally if it is the ip is the hostname (dns) is informed the full mode is not a problem no?
server.ssl.clientAuthentication: required
I commented on it, it doesn't seem necessary.
Here are the error feedbacks from elasticsearch
[2022-10-24T16:12:05,205][WARN ][o.e.h.AbstractHttpServerTransport] [node-4] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/192.168.1.40:9200, remoteAddress=/192.168.1.80:35384}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
[2022-10-24T16:12:06,290][WARN ][o.e.c.s.DiagnosticTrustManager] [node-4] failed to establish trust with client at [<unknown host>]; the client provided a certificate with subject name [CN=kibana1], fingerprint [c9a35b1c12ec10f39e00c9f920613e4be7dd4bf5], no keyUsage and no extendedKeyUsage; the session uses cipher suite [TLS_AES_256_GCM_SHA384] and protocol [TLSv1.3]; the certificate is issued by [CN=Elastic Certificate Tool Autogenerated CA]; the certificate is signed by (subject [CN=Elastic Certificate Tool Autogenerated CA] fingerprint [a6781c1ac84dbe52b929942e418ff19cc42bf8b7]) which is self-issued; the [CN=Elastic Certificate Tool Autogenerated CA] certificate is not trusted in this ssl context ([xpack.security.http.ssl (with trust configuration: StoreTrustConfig{path=/etc/elasticsearch/new/http.p12, password=<non-empty>, type=PKCS12, algorithm=PKIX})]); this ssl context does trust a certificate with subject [CN=Elastic Certificate Tool Autogenerated CA] but the trusted certificate has fingerprint [2d8da61f994c4a727e8378ae4f76433ed014d6e2]
sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
