# Using a certificate to authenticate the Kibana Server user

**URL:** <https://forum.search-guard.com/t/using-a-certificate-to-authenticate-the-kibana-server-user/572>\
**Category:** Search Guard\
**Created:** [August 18, 2017, 7:28pm UTC](https://forum.search-guard.com/t/using-a-certificate-to-authenticate-the-kibana-server-user/572 "2017-08-18T19:28:09Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![andrewjpfoster](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@andrewjpfoster](https://forum.search-guard.com/u/andrewjpfoster)\
**Post date:** [August 18, 2017, 7:28pm UTC](https://forum.search-guard.com/t/using-a-certificate-to-authenticate-the-kibana-server-user/572/1 "2017-08-18T19:28:09Z")

</div>

Hi there,  
I would like to use a certificate to authenticate the Kibana Server user, but then use basic HTTP authentication with the internal users backend for regular Kibana users (and once I’ve got that working, want to use LDAP as well). I would like to avoid storing a plain text password in the kibana.yml config file.  
The certificate’s CN is kibanaserver. When I am presented with the SG login page, it makes no difference what I use as a username and password. It always authenticates me as user ‘CN=kibanaserver’.  
Is there a way I can use certificate authentication _only_ for the Kibana Server user, and then use whatever alternative authentication methods for ‘regular’ users?

I am using ES 5.5.1 with plugin v. 5.5.1-15, Kibana plugin v. 5.5.1-4.

I have this in my kibana.yml file:

elasticsearch.ssl.verificationMode: full

searchguard.basicauth.enabled: true  
searchguard.cookie.secure: true  
searchguard.cookie.password: ‘a-random-32-character-password’  
searchguard.session.ttl: 1440000000  
searchguard.session.keepalive: true

server.ssl.enabled: true  
server.ssl.certificate: ‘/etc/kibana/kibana.cert.pem’  
server.ssl.key: ‘/etc/kibana/kibana.key.pem’

elasticsearch.ssl.certificate: ‘/etc/kibana/kibanaserver.cert.pem’  
elasticsearch.ssl.key: ‘/etc/kibana/kibana.key.pem’

elasticsearch.ssl.certificateAuthorities: [‘/etc/kibana/ca-chain.cert.pem’]

``

And this is my authc section of sg\_config.yml

```
authc:
  kibana_auth_domain:
    enabled: true
    order: 1
    http_authenticator:
      type: clientcert
      challenge: false
    authentication_backend:
      type: noop

  basic_internal_auth_domain:
    enabled: true
    order: 2
    http_authenticator:
      type: basic
      challenge: true
    authentication_backend:
      type: intern

```

``