Skip to content
This repository has been archived by the owner on Aug 2, 2022. It is now read-only.

Can't access to Kibana : "[ConnectionError]: self signed certificate" with Helm #783

Open
Nastaszja opened this issue Sep 2, 2021 · 0 comments

Comments

@Nastaszja
Copy link

I used Helm in order to install Open Distro for ElasticSearch.

My goal is to have a secure configuration with encryption of data.

I followed this tutorial : https://aws.amazon.com/fr/blogs/opensource/add-ssl-certificates-open-distro-for-elasticsearch/
where I created a local, self-signed Certificate Authority using OpenSSL and all the other certificates.

I made all the necessary secrets :
elasticsearch-account
elasticsearch-admin-certs
elasticsearch-rest-certs
elasticsearch-transport-certs
kibana-certs

I filled the config part for both Kibana and Elasticsearch in values.yaml

My Kibana Config part is as follow:

  config:
    ## Default Kibana configuration from kibana-docker.
    server.name: kibana
    server.host: "0"

    elasticsearch.hosts: "https://es-main-opendistro-es-client-service:9200"
    elasticsearch.requestTimeout: 360000

    logging.verbose: true

    ## Kibana TLS Config
    server.ssl.enabled: true
    server.ssl.key: /usr/share/kibana/certs/kibana-key.pem
    server.ssl.certificate: /usr/share/kibana/certs/kibana-crt.pem

    opendistro_security.cookie.secure: true
    opendistro_security.cookie.password: ${COOKIE_PASS}

    elasticsearch.username: ${ELASTICSEARCH_USERNAME}
    elasticsearch.password: ${ELASTICSEARCH_PASSWORD}

    opendistro_security.allow_client_certificates: true

    elasticsearch.ssl.certificate: /usr/share/kibana/certs/elk-rest-crt.pem
    elasticsearch.ssl.key: /usr/share/kibana/certs/elk-rest-key.pem
    elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/certs/elk-rest-root-ca.pem"]

    opendistro_security.multitenancy.enabled: true
    opendistro_security.multitenancy.tenants.enable_private: false
    opendistro_security.multitenancy.tenants.enable_global: false
    opendistro_security.readonly_mode.roles: ["kibana_read_only"]

    elasticsearch.requestHeadersWhitelist: ["securitytenant","Authorization"]

My ElasticSearch config is as follows:

  config:
    opendistro_security.audit.ignore_users: ["kibanaserver"]
    opendistro_security.allow_unsafe_democertificates: false
    opendistro_security.allow_default_init_securityindex: true #
    opendistro_security.audit.type: internal_elasticsearch
    opendistro_security.roles_mapping_resolution: BOTH
    opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]

    opendistro_security.nodes_dn:
      - "CN=SS,OU=OPS,O=SS,L=Paris,ST=Paris,C=FR"

    opendistro_security.authcz.admin_dn:
      - "CN=SSA,OU=ADMIN,O=SS,L=Paris,ST=Paris,C=FR"
    opendistro_security.audit.config.disabled_rest_categories: NONE
    opendistro_security.audit.config.disabled_transport_categories: NONE

    node:
      max_local_storage_nodes: 1
      attr.box_type: hot


    processors: ${PROCESSORS:1}
    thread_pool.write.queue_size: 800

    http:
      compression: true

    # # TLS Configuration Transport Layer
    opendistro_security.ssl.transport.pemcert_filepath: elk-transport-crt.pem
    opendistro_security.ssl.transport.pemkey_filepath: elk-transport-key.pem
    opendistro_security.ssl.transport.pemtrustedcas_filepath: elk-transport-root-ca.pem
    opendistro_security.ssl.transport.enforce_hostname_verification: false #

    # # TLS Configuration REST Layer
    opendistro_security.ssl.http.enabled: true
    opendistro_security.ssl.http.pemcert_filepath: elk-rest-crt.pem
    opendistro_security.ssl.http.pemkey_filepath: elk-rest-key.pem
    opendistro_security.ssl.http.pemtrustedcas_filepath: elk-rest-root-ca.pem

When I am looking at my Kibana's logs, I constantly have :

{"type":"log","@timestamp":"2021-09-02T21:38:59Z","tags":["error","elasticsearch","data"],"pid":1,"message":"[ConnectionError]: self signed certificate"}
{"type":"log","@timestamp":"2021-09-02T21:39:02Z","tags":["error","elasticsearch","data"],"pid":1,"message":"[ConnectionError]: self signed certificate"}
{"type":"log","@timestamp":"2021-09-02T21:39:04Z","tags":["debug","metrics"],"pid":1,"message":"Refreshing metrics"}
{"type":"log","@timestamp":"2021-09-02T21:39:04Z","tags":["error","elasticsearch","data"],"pid":1,"message":"[ConnectionError]: self signed certificate"}

The logs of the master node, the client node and the data node don't show any errors.

Sorry if something is not clear, I am not familiar with SSL/TLS certificates.
Do you know how can I resolve my issue?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant