# Windows: establishing SSL communication in ELK using searchguard
**URL:** https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502
**Category:** Search Guard
**Created:** [July 3, 2017, 11:29am UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502 "2017-07-03T11:29:48Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@vinod\_hy](https://forum.search-guard.com/u/vinod_hy)
#### Post date: [July 3, 2017, 11:29am UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/1 "2017-07-03T11:29:48Z")
Hi,
I am new to searchguard.
My intention is to establish a secure communication in the ELK communication.
Following are the changes that i have performed initially,
**Elasticsearch.yml**
searchguard.authcz.admin\_dn:
- CN=sgadmin
searchguard.ssl.transport.keystore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\CN=localhost-keystore.jks
searchguard.ssl.transport.keystore\_password: 221749a2add117cf889f
searchguard.ssl.transport.truststore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\truststore.jks
searchguard.ssl.transport.truststore\_password: 6d6cf1cc017dc874960b
**Kibana.yml**
elasticsearch.url: “[http://localhost:9200](http://localhost:9200)”
elasticsearch.username: “admin”
elasticsearch.password: “admin”
**Logstash.config**
output {
elasticsearch {
```
hosts => ["localhost:9200"]
user => admin
```
password =\> admin
```
}
stdout { codec => rubydebug }
```
}
With the above changes, i was able to login to kibana and elasticsearch using cerdentials \*\*admin/admin . \*\*
Now i want to login to elasticsearch and kibana using https.
following are the changes i performed,
**Elasticsearch.yml**
searchguard.ssl.http.enabled: true
searchguard.ssl.http.keystore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\CN=localhost-keystore.jks
searchguard.ssl.http.keystore\_password: 221749a2add117cf889f
searchguard.ssl.http.truststore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\truststore.jks
searchguard.ssl.http.truststore\_password: 6d6cf1cc017dc874960b
searchguard.authcz.admin\_dn:
- CN=sgadmin
searchguard.ssl.transport.keystore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\CN=localhost-keystore.jks
searchguard.ssl.transport.keystore\_password: 221749a2add117cf889f
searchguard.ssl.transport.truststore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\truststore.jks
searchguard.ssl.transport.truststore\_password: 6d6cf1cc017dc874960b
With this, i was able to login to elasticsearch using https.
But i want to know what changes i need to do in **Kibana.yml** and **logstash.config .**
Please help me in the regard. I am not able to find info online.
---
### Author:  [@vinod\_hy](https://forum.search-guard.com/u/vinod_hy)
#### Post date: [July 3, 2017, 12:22pm UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/2 "2017-07-03T12:22:22Z")
> Hi,
I added the below line in kibana.yml,
\*elasticsearch.ssl.ca: “D:/Softwares/ELK/elasticsearch-5.4.0/elasticsearch-5.4.0/config/root-ca.crt” \*
and i am able to login into localhost:5601 using admin/admin.
But my requirement is to login using [https://localhost:5601](https://localhost:5601) …
Please help me here
---
### Author:  [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)
#### Post date: [July 3, 2017, 12:26pm UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/3 "2017-07-03T12:26:16Z")
Kibana.yml:
elasticsearch.url: "[https://localhost:9200](https://localhost:9200)"
elasticsearch.username: "admin"
elasticsearch.password: "admin"
elasticsearch.ssl.verify: false
Logstash.config:
output {
elasticsearch {
hosts =\> ["[https://localhost:9200](https://localhost:9200)"]
user =\> admin
password =\> admin
ssl\_certificate\_verification =\> false
}
stdout { codec =\> rubydebug }
}
Just change http:// to https:// (like in your brwoser when you want to reach the ssl version of the webseite)
Docs can be found here:
[https://github.com/floragunncom/search-guard-docs/blob/master/kibana.md](https://github.com/floragunncom/search-guard-docs/blob/master/kibana.md)
[https://github.com/floragunncom/search-guard-docs/blob/master/logstash.md](https://github.com/floragunncom/search-guard-docs/blob/master/logstash.md)
> **[search-guard-docs](http://floragunncom.github.io/search-guard-docs/)**
>
> Official documentation for Search Guard, the Elasticsearch security suite
If you get this working than remove enable certificate verification by setting:
Kibana.yml:
elasticsearch.url: "[https://localhost:9200](https://localhost:9200)"
elasticsearch.username: "admin"
elasticsearch.password: "admin"
elasticsearch.ssl.verify: true
elasticsearch.ssl.certificateAuthorities: ["/path/to/your/root-ca.pem"]
Logstash.config:
output {
elasticsearch {
hosts =\> ["[https://localhost:9200](https://localhost:9200)"]
user =\> admin
password =\> admin
ssl\_certificate\_verification =\> true
truststore =\> "/path/to/truststore.jks"
truststore\_password =\> "changeit"
}
stdout { codec =\> rubydebug }
}
You can also have a look here:
> **[Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/index.html)**
> **[Elasticsearch output plugin | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html)**
> **[Configure Kibana | Kibana Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/kibana/current/settings.html)**
> **···**
>
> > Am 03.07.2017 um 13:29 schrieb vinod hy \:
> >
> > Hi,
> >
> > I am new to searchguard.
> >
> > My intention is to establish a secure communication in the ELK communication.
> >
> > Following are the changes that i have performed initially,
> >
> > Elasticsearch.yml
> >
> > searchguard.authcz.admin\_dn:
> > - CN=sgadmin
> >
> > searchguard.ssl.transport.keystore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\CN=localhost-keystore.jks
> > searchguard.ssl.transport.keystore\_password: 221749a2add117cf889f
> > searchguard.ssl.transport.truststore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\truststore.jks
> > searchguard.ssl.transport.truststore\_password: 6d6cf1cc017dc874960b
> >
> > Kibana.yml
> > elasticsearch.url: "[http://localhost:9200](http://localhost:9200)"
> > elasticsearch.username: "admin"
> > elasticsearch.password: "admin"
> >
> > Logstash.config
> > output {
> > elasticsearch {
> > hosts =\> ["localhost:9200"]
> > user =\> admin
> > password =\> admin
> > }
> > stdout { codec =\> rubydebug }
> > }
> >
> > With the above changes, i was able to login to kibana and elasticsearch using cerdentials admin/admin .
> > Now i want to login to elasticsearch and kibana using https.
> >
> > following are the changes i performed,
> >
> > Elasticsearch.yml
> >
> > searchguard.ssl.http.enabled: true
> > searchguard.ssl.http.keystore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\CN=localhost-keystore.jks
> > searchguard.ssl.http.keystore\_password: 221749a2add117cf889f
> > searchguard.ssl.http.truststore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\truststore.jks
> > searchguard.ssl.http.truststore\_password: 6d6cf1cc017dc874960b
> >
> > searchguard.authcz.admin\_dn:
> > - CN=sgadmin
> >
> > searchguard.ssl.transport.keystore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\CN=localhost-keystore.jks
> > searchguard.ssl.transport.keystore\_password: 221749a2add117cf889f
> > searchguard.ssl.transport.truststore\_filepath: D:\Softwares\ELK\elasticsearch-5.4.0\elasticsearch-5.4.0\config\truststore.jks
> > searchguard.ssl.transport.truststore\_password: 6d6cf1cc017dc874960b
> >
> > With this, i was able to login to elasticsearch using https.
> >
> > But i want to know what changes i need to do in Kibana.yml and logstash.config .
> >
> > Please help me in the regard. I am not able to find info online.
> >
> > --
> > You received this message because you are subscribed to the Google Groups "Search Guard" group.
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.
> > To post to this group, send email to search-guard@googlegroups.com.
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/c225afe0-07a0-45bb-8ef6-35ef49fe4e0d%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/c225afe0-07a0-45bb-8ef6-35ef49fe4e0d%40googlegroups.com%5C).
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).
---
### Author:  [@vinod\_hy](https://forum.search-guard.com/u/vinod_hy)
#### Post date: [July 4, 2017, 6:22am UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/4 "2017-07-04T06:22:18Z")
Hi,
Thanks a lot for your inputs.
I directly tried the second part of your explanation. I got it working but
there is one issue which i observed.
\*In kibana.yml:\*
\*If i add the line,\*
elasticsearch.ssl.verify: true,
i get the below error in kibana logs.
\*{"type":"log","@timestamp":"2017-07-04T06:10:29Z","tags":["fatal"],"pid":17172,"level":"fatal","message":"child
\"elasticsearch\" fails because [child \"ssl\" fails because [\"enabled\"
is not allowed]]","error":{"message":"child \"elasticsearch\" fails because
[child \"ssl\" fails because [\"enabled\" is not
allowed]]","name":"ValidationError","stack":"ValidationError: child
\"elasticsearch\" fails because [child \"ssl\" fails because [\"enabled\"
is not allowed]]\n at Object.exports.process
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\node\_modules\\joi\\lib\\errors.js:140:17)\n
at internals.Any.\_validateWithOptions
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\node\_modules\\joi\\lib\\any.js:649:25)\n
at root.validate
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\node\_modules\\joi\\lib\\index.js:102:23)\n
at Config.\_commit
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\src\\server\\config\\config.js:113:35)\n
at Config.set
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\src\\server\\config\\config.js:84:10)\n
at Config.extendSchema
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\src\\server\\config\\config.js:57:10)\n
at
D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\src\\server\\plugins\\plugin\_collection.js:19:12\n
at next (native)\n at step
(D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\src\\server\\plugins\\plugin\_collection.js:49:191)\n
at
D:\\Softwares\\ELK\\kibana-5.4.0-windows-x86\\kibana-5.4.0-windows-x86\\src\\server\\plugins\\plugin\_collection.js:49:361"}}\*
So i used the configuration files as below,
These below configuration worked fine for me.
\*kibana.yml\*
elasticsearch.url: "[https://localhost:9200](https://localhost:9200)"
elasticsearch.username: "admin"
elasticsearch.password: "admin"
elasticsearch.ssl.certificateAuthorities: [
"D:/Softwares/ELK/elasticsearch-5.4.0/elasticsearch-5.4.0/config/root-ca.crt"
]
\*logstash.config\*
output {
elasticsearch {
hosts =\> ["localhost:9200"]
user =\> admin
password =\> admin
ssl =\> true
ssl\_certificate\_verification =\> true
truststore =\>
"D:/Softwares/ELK/elasticsearch-5.4.0/elasticsearch-5.4.0/config/truststore.jks"
truststore\_password =\> "6d6cf1cc017dc874960b"
}
stdout { codec =\> rubydebug }
}
\*My doubts\*
1. Please let me know why \*elasticsearch.ssl.verify: true \*in kibana.yml is
throwing error. Is it ok to omit this line.
2. Now i want to use openssl certificates instead of jks. Please help me in
using open ssl.
---
### Author:  [@jkressin](https://forum.search-guard.com/u/jkressin)
#### Post date: [July 4, 2017, 9:09am UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/5 "2017-07-04T09:09:31Z")
What’s with the OpenSSL / JKS question? A jks container simply stores certificates in a certain format. Use the keytool command to work with JKS container:
[https://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html](https://docs.oracle.com/javase/6/docs/technotes/tools/solaris/keytool.html)
Your OpenSSL certificates are there already, inside the container.
Please read also the docs regarding Kibana and logstash setup:
> **[Installing the Plugin](http://floragunncom.github.io/search-guard-docs/kibana.html)**
>
> How to install the Search Guard Kibana plugin which adds authentication, multi-tenancy and the configuration UI.
> **[Search Guard Documentation 404](http://floragunncom.github.io/search-guard-docs/logstash.html)**
>
> Seems like the page you are looking for does not exist. We deeply and humbly apologize.
There you will find:
You can disable certificate validation in `kibana.yml`:
Kibana \>= 5.3.0
```auto
elasticsearch.ssl.verificationMode: none
```
Kibana \< 5.3.0:
```auto
elasticsearch.ssl.verify: false
```
` `
This is a configuration changed introduced by Kibana in 5.3.0.
> **···**
>
> On Tuesday, July 4, 2017 at 8:22:20 AM UTC+2, vinod hy wrote:
>
> > Hi,
>
> >
>
> > Thanks a lot for your inputs.
>
> >
>
> > I directly tried the second part of your explanation. I got it working but there is one issue which i observed.
>
> >
>
> > **In kibana.yml:**
>
> > **If i add the line,**
>
> > elasticsearch.ssl.verify: true,
>
> >
>
> > i get the below error in kibana logs.
>
> > _{“type”:“log”,“@timestamp”:“2017-07-04T06:10:29Z”,“tags”:[“fatal”],“pid”:17172,“level”:“fatal”,“message”:“child "elasticsearch" fails because [child "ssl" fails because ["enabled" is not allowed]]”,“error”:{“message”:“child "elasticsearch" fails because [child "ssl" fails because ["enabled" is not allowed]]”,“name”:“ValidationError”,“stack”:“ValidationError: child "elasticsearch" fails because [child "ssl" fails because ["enabled" is not allowed]]\n at Object.exports.process (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\node\_modules\joi\lib\errors.js:140:17)\n at internals.Any.\_validateWithOptions (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\node\_modules\joi\lib\any.js:649:25)\n at root.validate (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\node\_modules\joi\lib\index.js:102:23)\n at Config.\_commit (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\src\server\config\config.js:113:35)\n at Config.set (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\src\server\config\config.js:84:10)\n at Config.extendSchema (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\src\server\config\config.js:57:10)\n at D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\src\server\plugins\plugin\_collection.js:19:12\n at next (native)\n at step (D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\src\server\plugins\plugin\_collection.js:49:191)\n at D:\Softwares\ELK\kibana-5.4.0-windows-x86\kibana-5.4.0-windows-x86\src\server\plugins\plugin\_collection.js:49:361”}}_
>
> > So i used the configuration files as below,
>
> >
>
> > These below configuration worked fine for me.
>
> >
>
> > **kibana.yml**
>
> >
>
> > elasticsearch.url: “[https://localhost:9200](https://localhost:9200)”
>
> > elasticsearch.username: “admin”
>
> > elasticsearch.password: “admin”
>
> > elasticsearch.ssl.certificateAuthorities: [“D:/Softwares/ELK/elasticsearch-5.4.0/elasticsearch-5.4.0/config/root-ca.crt”]
>
> >
>
> > **logstash.config**
>
> > output {
>
> > elasticsearch {
>
> > hosts =\> [“localhost:9200”]
>
> > user =\> admin
>
> > password =\> admin
>
> > ssl =\> true
>
> > ssl\_certificate\_verification =\> true
>
> > truststore =\> “D:/Softwares/ELK/elasticsearch-5.4.0/elasticsearch-5.4.0/config/truststore.jks”
>
> > truststore\_password =\> “6d6cf1cc017dc874960b”
>
> > }
>
> > stdout { codec =\> rubydebug }
>
> > }
>
> >
>
> > **My doubts**
>
> >
>
> > 1. Please let me know why **elasticsearch.ssl.verify: true** in kibana.yml is throwing error. Is it ok to omit this line.
>
> > 1. Now i want to use openssl certificates instead of jks. Please help me in using open ssl.
>
> >
---
### Author:  [@vinod\_hy](https://forum.search-guard.com/u/vinod_hy)
#### Post date: [July 5, 2017, 7:09am UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/6 "2017-07-05T07:09:09Z")
> > Hi Jochen,
I really appreciate your time and patience.
i will elaborate my situation to make you understand better.
I have attached the self signed certificates which i have generated using openssl command line tool. Please go through the attachment for the same.
Now, I want to use these certificates instead of using the one which i got generated from searchguard certificate generator link.
But these certificates doesnt have truststore and keystore password as present in readme document of searchguard certificates.
May i please know how to handle this. Please let me know if i am missing anything here.
[SSLCertificates.zip](https://forum.search-guard.com/uploads/short-url/tm9mnq72CRjFxpZJFnusGrIqBGp.zip) (19.2 KB)
---
### Author:  [@vinod\_hy](https://forum.search-guard.com/u/vinod_hy)
#### Post date: [July 5, 2017, 7:29am UTC](https://forum.search-guard.com/t/windows-establishing-ssl-communication-in-elk-using-searchguard/502/7 "2017-07-05T07:29:54Z")
Please explain me some some points here on what knowledge i am missing here.
Then i will go through relavant links online and understand better.
My requirement is to use my own certificates instead of using the certificates which i generated using searchguard certificate generator.
I have generated my own self certtificates using openssl command line tool.