# XPack Kibana Monitoring will not accept certificateAuthority

**URL:** <https://discuss.elastic.co/t/xpack-kibana-monitoring-will-not-accept-certificateauthority/106277>\
**Category:** Kibana\
**Created:** [November 3, 2017, 8:04am UTC](https://discuss.elastic.co/t/xpack-kibana-monitoring-will-not-accept-certificateauthority/106277 "2017-11-03T08:04:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![das-chick](https://avatars.discourse-cdn.com/v4/letter/d/4af34b/32.png) [@das-chick](https://discuss.elastic.co/u/das-chick)\
**Post date:** [November 3, 2017, 8:04am UTC](https://discuss.elastic.co/t/xpack-kibana-monitoring-will-not-accept-certificateauthority/106277/1 "2017-11-03T08:04:54Z")

</div>

We're setting up a Elasticcluster in Version 6.0.0-rc1 with xpack security enabled.  
kibana.yml looks like:  
xpack.security.enabled: true  
server.ssl.enabled: true  
elasticsearch.url: "[https://elasticsearch1.elkxpack.svc:9200](https://elasticsearch1.elkxpack.svc:9200)"  
server.ssl.certificate: config/certs/tls.crt  
server.ssl.key: config/certs/tls.key  
xpack.monitoring.ui.container.elasticsearch.enabled: true  
server.ssl.certificateAuthorities: ["/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"]  
elasticsearch.ssl.certificateAuthorities: ["/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt"]

curling elasticsearch from kibana with the ca works:  
sh-4.2$ curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt -u kibana:changeme [https://elasticsearch1.elkxpack.svc:9200](https://elasticsearch1.elkxpack.svc:9200)  
{  
"name" : "elasticsearch1",  
"cluster\_name" : "elk",  
"cluster\_uuid" : "L065EzgLTB2eMfgntPxYSw",  
"version" : {  
"number" : "6.0.0-rc1",  
"build\_hash" : "b9c0df2",  
"build\_date" : "2017-09-25T19:11:45.815Z",  
"build\_snapshot" : false,  
"lucene\_version" : "7.0.0",  
"minimum\_wire\_compatibility\_version" : "5.6.0",  
"minimum\_index\_compatibility\_version" : "5.0.0"  
},  
"tagline" : "You Know, for Search"  
}

But kibana monitoring will not accept the ca. thats what i found in the log  
{"type":"log","@timestamp":"2017-10-26T16:13:30Z","tags":["warning","elasticsearch","monitoring-ui"],"pid":1,"message":"Unable to revive connection: [https://elasticsearch1.elkxpack.svc:9200/](https://elasticsearch1.elkxpack.svc:9200/)"}

any ideas?

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 10, 2017, 4:56pm UTC](https://discuss.elastic.co/t/xpack-kibana-monitoring-will-not-accept-certificateauthority/106277/2 "2017-11-10T16:56:25Z")

</div>

Does adding the following settings to kibana.yml resolve the issue?

```auto
- xpack.monitoring.elasticsearch.ssl.certificate
- xpack.monitoring.elasticsearch.ssl.key

```

The connection to Elasticsearch for the Monitoring app might not be inheriting these settings from `server.ssl` correctly.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 10, 2017, 5:25pm UTC](https://discuss.elastic.co/t/xpack-kibana-monitoring-will-not-accept-certificateauthority/106277/3 "2017-11-10T17:25:41Z")

</div>

Following up, I think I was able to reproduce your issue, and I got it to work by just adding the 1 setting for

`xpack.monitoring.elasticsearch.ssl.certificateAuthorities`

to the same value as

`elasticsearch.ssl.certificateAuthorities`

Seems like a bug - it should work automatically. I will file an issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2017, 5:26pm UTC](https://discuss.elastic.co/t/xpack-kibana-monitoring-will-not-accept-certificateauthority/106277/4 "2017-12-08T17:26:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.