# Unable to retrieve version information from Elasticsearch nodes. security\_exception

**URL:** <https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [November 18, 2023, 2:17am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442 "2023-11-18T02:17:18Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sp0ydiYO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sp0ydiyo/32/127706_2.png) [@sp0ydiYO](https://discuss.elastic.co/u/sp0ydiYO)\
**Post date:** [November 18, 2023, 2:17am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442/1 "2023-11-18T02:17:18Z")

</div>

I've read other related questions and I confirmed this is a new question

I have started the elasticsearch service, but because other clients will report certificate errors, I turned off ssl in config/elasticsearch.yml

```auto
# elasticsearch.yml
# Enable security features
xpack.security.enabled: true

xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: false
  keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: false
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12

```

This allows me to use http requests to run information

```auto
PS D:\workspace> curl -u elastic:password http://192.168.1.116:9200/
{
  "name" : "DESKTOP-2UC2O3V",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "w5AagL97RGWHEWN2qKbQ5w",
  "version" : {
    "number" : "8.11.1",
    "build_flavor" : "default",
    "build_type" : "zip",
    "build_hash" : "6f9ff581fbcde658e6f69d6ce03050f060d1fd0c",
    "build_date" : "2023-11-11T10:05:59.421038163Z",
    "build_snapshot" : false,
    "lucene_version" : "9.8.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}
PS D:\workspace>

```

But when I start kibana, the console will report an error

```auto
[2023-11-18T09:51:12.910+08:00][ERROR][elasticsearch-service] Unable to retrieve version information from Elasticsearch nodes. security_exception
        Root causes:
                security_exception: missing authentication credentials for REST request [/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip]

```

But when I use curl to request this address, there is no problem

```auto
PS D:\workspace> curl -u elastic:password http://192.168.1.116:9200/_nodes?filter_path=nodes.*.version%2Cnodes.*.http.publish_address%2Cnodes.*.ip
{"nodes":{"oIXkXqt7RJiwVY7mwm8alA":{"ip":"127.0.0.1","version":"8.11.1","http":{"publish_address":"172.22.48.1:9200"}}}}

```

Even when I stop elasticsearch, I can start kibana normally. I speculate that when kibana starts, it will first determine whether there is an elasticsearch service locally. If so, it will directly request the local one without entering the configuration?

I also tried modifying the ssl verification in kibana.yml

```auto
# kibana.yml
elasticsearch.ssl.verificationMode: none

```

But he still doesn't work properly,  
When I open localhos:5601, it says

```auto
Kibana server is not ready yet.

```

What should I do now to ignore ssl when kibana requests elasticsearch

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 18, 2023, 2:54am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442/2 "2023-11-18T02:54:47Z")

</div>

> [@sp0ydiYO](#):
>
> `security_exception: missing authentication credentials for REST request`

What does your `kibana.yml` looks like? You didn't share.

The error clearly states that the credentials to access Elasticsearch era missing.

Please share your `kibana.yml`.

---

<div class="post-metadata">

**Author:** ![sp0ydiYO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sp0ydiyo/32/127706_2.png) [@sp0ydiYO](https://discuss.elastic.co/u/sp0ydiYO)\
**Post date:** [November 18, 2023, 3:02am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442/3 "2023-11-18T03:02:54Z")

</div>

thank you,

I can tell that it is because of the certificate problem, but I have changed it to disable SSL. How can I make kibana also disable SSL?

For the default kibana.yml, I only modified

```auto
elasticsearch.ssl.verificationMode: none

```

full kibana.yml file is

```auto
# For more configuration options see the configuration guide for Kibana in
# https://www.elastic.co/guide/index.html

# =================== System: Kibana Server ===================
# Kibana is served by a back end server. This setting specifies the port to use.
#server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
#server.host: "localhost"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.
# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath
# from requests it receives, and to prevent a deprecation warning at startup.
# This setting cannot end in a slash.
#server.basePath: ""

# Specifies whether Kibana should rewrite requests that are prefixed with
# `server.basePath` or require that they are rewritten by your reverse proxy.
# Defaults to `false`.
#server.rewriteBasePath: false

# Specifies the public URL at which Kibana is available for end users. If
# `server.basePath` is configured this URL should end with the same basePath.
#server.publicBaseUrl: ""

# The maximum payload size in bytes for incoming server requests.
#server.maxPayload: 1048576

# The Kibana server's name. This is used for display purposes.
#server.name: "your-hostname"

# =================== System: Kibana Server (Optional) ===================
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
#server.ssl.enabled: false
#server.ssl.certificate: /path/to/your/server.crt
#server.ssl.key: /path/to/your/server.key

# =================== System: Elasticsearch ===================
# The URLs of the Elasticsearch instances to use for all your queries.
# elasticsearch.hosts: "http://192.168.1.116:9200"

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
# elasticsearch.username: "elastic"
# elasticsearch.password: "ops@2025!@#"

# Kibana can also authenticate to Elasticsearch via "service account tokens".
# Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.
# Use this token instead of a username/password.
# elasticsearch.serviceAccountToken: ""

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
#elasticsearch.pingTimeout: 1500

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
#elasticsearch.requestTimeout: 30000

# The maximum number of sockets that can be used for communications with elasticsearch.
# Defaults to `Infinity`.
#elasticsearch.maxSockets: 1024

# Specifies whether Kibana should use compression for communications with elasticsearch
# Defaults to `false`.
#elasticsearch.compression: false

# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
# headers, set this value to [] (an empty list).
#elasticsearch.requestHeadersWhitelist: [authorization]

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
#elasticsearch.customHeaders: {}

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
#elasticsearch.shardTimeout: 30000

# =================== System: Elasticsearch (Optional) ===================
# These files are used to verify the identity of Kibana to Elasticsearch and are required when
# xpack.security.http.ssl.client_authentication in Elasticsearch is set to required.
#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key

# Enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
#elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.pem"]

# To disregard the validity of SSL certificates, change this setting's value to 'none'.
elasticsearch.ssl.verificationMode: none

# =================== System: Logging ===================
# Set the value of this setting to off to suppress all logging output, or to debug to log everything. Defaults to 'info'
#logging.root.level: debug

# Enables you to specify a file where Kibana stores log output.
#logging.appenders.default:
# type: file
# fileName: /var/logs/kibana.log
# layout:
# type: json

# Logs queries sent to Elasticsearch.
#logging.loggers:
# - name: elasticsearch.query
# level: debug

# Logs http responses.
#logging.loggers:
# - name: http.server.response
# level: debug

# Logs system usage information.
#logging.loggers:
# - name: metrics.ops
# level: debug

# =================== System: Other ===================
# The path where Kibana stores persistent data not saved in Elasticsearch. Defaults to data
#path.data: data

# Specifies the path where Kibana creates the process ID file.
#pid.file: /run/kibana/kibana.pid

# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000ms.
#ops.interval: 5000

# Specifies locale to be used for all localizable strings, dates and number formats.
# Supported languages are the following: English (default) "en", Chinese "zh-CN", Japanese "ja-JP", French "fr-FR".
i18n.locale: "en"

# =================== Frequently used (Optional)===================

# =================== Saved Objects: Migrations ===================
# Saved object migrations run at startup. If you run into migration-related issues, you might need to adjust these settings.

# The number of documents migrated at a time.
# If Kibana can't start up or upgrade due to an Elasticsearch `circuit_breaking_exception`,
# use a smaller batchSize value to reduce the memory pressure. Defaults to 1000 objects per batch.
#migrations.batchSize: 1000

# The maximum payload size for indexing batches of upgraded saved objects.
# To avoid migrations failing due to a 413 Request Entity Too Large response from Elasticsearch.
# This value should be lower than or equal to your Elasticsearch cluster’s `http.max_content_length`
# configuration option. Default: 100mb
#migrations.maxBatchSizeBytes: 100mb

# The number of times to retry temporary migration failures. Increase the setting
# if migrations fail frequently with a message such as `Unable to complete the [...] step after
# 15 attempts, terminating`. Defaults to 15
#migrations.retryAttempts: 15

# =================== Search Autocomplete ===================
# Time in milliseconds to wait for autocomplete suggestions from Elasticsearch.
# This value must be a whole number greater than zero. Defaults to 1000ms
#unifiedSearch.autocomplete.valueSuggestions.timeout: 1000

# Maximum number of documents loaded by each shard to generate autocomplete suggestions.
# This value must be a whole number greater than zero. Defaults to 100_000
#unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 100000

# This section was automatically generated during setup.

# This section was automatically generated during setup.

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 18, 2023, 5:32am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442/4 "2023-11-18T05:32:00Z")

</div>

Hi @sp0ydiYO welcome to the community!

Your Kibana is not configured correctly

You do not have the following set.

`elasticsearch.hosts: "http://192.168.1.116:9200"`

That should be https

Also you do not have the username or password set ...

AND

You can not use `elastic` as the user for Kibana to connect to elasticsearch that is not allowed you need to `kibana_system` and the password for that.

> kibana\_system  
> The user Kibana uses to connect and communicate with Elasticsearch.

If you do not know it you will need to reset it using

> **[elasticsearch-reset-password | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/reset-password.html)**

> **[Set up minimal security for Elasticsearch | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-minimal-setup.html#add-built-in-users)**

But you don't need to use the elasticsearch secure keystore.

---

<div class="post-metadata">

**Author:** ![sp0ydiYO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sp0ydiyo/32/127706_2.png) [@sp0ydiYO](https://discuss.elastic.co/u/sp0ydiYO)\
**Post date:** [November 18, 2023, 6:00am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442/5 "2023-11-18T06:00:11Z")

</div>

Thank you very much for your help, my problem has been solved

Because I was able to successfully configure and enter kibana when I enabled SSL at the beginning, I misunderstood the error message. The solution has always been around SSL.

I reset the password of kibana\_system and added it to kibana-keystore. Now I can log in normally.

Thanks again for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 16, 2023, 6:01am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/347442/6 "2023-12-16T06:01:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.