Complete Guide: Installing and Configuring SSL/TLS Certificates on Elasticsearch and Kibana

This guide will walk you step by step through the installation of certificates on Elastic within your infrastructure. We will highlight the different stages to ensure a successful installation and configuration of the certificates.

Certificate Configuration

To secure communications within an Elastic cluster, you must import and configure SSL/TLS certificates.

1. Generating Certificates

Elastic provides a tool called elasticsearch-certutil to generate certificates. This tool can create self-signed certificates or certificates signed by a Certificate Authority (CA). Here is an example command to generate a self-signed certificate:

 ./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

2. certificate Distribution

Copy the generated certificates to each node in the Elastic cluster. You must also ensure that the nodes have access to their own certificate and private key, as well as to the certificate of the certification authority (CA).

3. Certificate settings in Elasticsearch

To configure the certificate, you need to edit the elasticsearch.yml file on each node to include the paths to the certificates and keys.

     xpack.security.transport.ssl.enabled: true

     xpack.security.transport.ssl.verification_mode: certificate

     xpack.security.transport.ssl.keystore.path: /path/to/your/keystore.p12

     xpack.security.transport.ssl.truststore.path: /path/to/your/truststore.p12

     xpack.security.http.ssl.enabled: true

     xpack.security.http.ssl.keystore.path: /path/to/your/keystore.p12

     xpack.security.http.ssl.truststore.path: /path/to/your/truststore.p12

4. Restarting the Nodes

After configuring the certificates, you need to restart the different Elasticsearch nodes to apply the changes.

sudo systemctl restart elasticsearch

5. Verifying the Configuration

To verify that communications are secured and working properly with the configured certificates, check the Elasticsearch logs and use tools like curl to test HTTPS connections.

curl -v -X GET https://localhost:9200 -u username:password --cacert /path/to/ca.crt

6. Certificate Configuration on Kibana

You can also configure Kibana to use HTTPS by editing the kibana.yml file after generating a CSR (Certificate Signing Request) for Kibana and having it signed by your Certificate Authority (CA):

     server.ssl.enabled: true

     server.ssl.certificate: /path/to/your/certificate.crt

     server.ssl.key: /path/to/your/certificate.key

Insitu IT: Your Elastic Ally

Properly configuring a master node in Elastic is essential to ensure the resilience and performance of your environment.

Want to go further? At INSITU IT, we help you set up, optimize, and monitor your Elastic infrastructures. Contact us for a personalized consultation.

Book a meeting