# 创建ca证书 [root@elastic-01 bin]# elasticsearch-certutil ca -bash: elasticsearch-certutil: command not found [root@elastic-01 bin]# ./elasticsearch-certutil ca This tool assists you in the generation of X.509 certificates and certificate signing requests for use with SSL/TLS in the Elastic stack.
The 'ca' mode generates a new 'certificate authority' This will create a new X.509 certificate and private key that can be used to sign certificate when running in 'cert' mode.
Use the 'ca-dn' option if you wish to configure the 'distinguished name' of the certificate authority
By default the 'ca' mode produces a single PKCS#12 output file which holds: * The CA certificate * The CA's private key
If you elect to generate PEM format certificates (the -pem option), then the output will be a zip file containing individual files for the CA certificate and private key
Please enter the desired output file [elastic-stack-ca.p12]: Enter password for elastic-stack-ca.p12 :
# 签证私钥 [root@elastic-01 bin]# ./elasticsearch-certutil cert --ca elastic-stack-ca.p12 This tool assists you in the generation of X.509 certificates and certificate signing requests for use with SSL/TLS in the Elastic stack.
The 'cert' mode generates X.509 certificate and private keys. * By default, this generates a single certificate and key for use on a single instance. * The '-multiple' option will prompt you to enter details for multiple instances and will generate a certificate and key for each one * The '-in' option allows for the certificate generation to be automated by describing the details of each instance in a YAML file
* An instance is any piece of the Elastic Stack that requires an SSL certificate. Depending on your configuration, Elasticsearch, Logstash, Kibana, and Beats may all require a certificate and private key. * The minimum required value for each instance is a name. This can simply be the hostname, which will be used as the Common Name of the certificate. A full distinguished name may also be used. * A filename value may be required for each instance. This is necessary when the name would result in an invalid file or directory name. The name provided here is used as the directory name (within the zip) and the prefix for the key and certificate files. The filename is required if you are prompted and the name is not displayed in the prompt. * IP addresses and DNS names are optional. Multiple values can be specified as a comma separated string. If no IP addresses or DNS names are provided, you may disable hostname verification in your SSL configuration.
* All certificates generated by this tool will be signed by a certificate authority (CA). * The tool can automatically generate a new CA for you, or you can provide your own with the -ca or -ca-cert command line options.
By default the 'cert' mode produces a single PKCS#12 output file which holds: * The instance certificate * The private key for the instance certificate * The CA certificate
If you specify any of the following options: * -pem (PEM formatted output) * -keep-ca-key (retain generated CA key) * -multiple (generate multiple certificates) * -in (generate certificates from an input file) then the output will be be a zip file containing individual certificate/key files
Enter password for CA (elastic-stack-ca.p12) : Please enter the desired output file [elastic-certificates.p12]: Enter password for elastic-certificates.p12 :
Certificates written to /usr/share/elasticsearch/elastic-certificates.p12
This file should be properly secured as it contains the private key for your instance.
This file is a self contained file and can be copied and used 'as is' For each Elastic product that you wish to configure, you should copy this '.p12' file to the relevant configuration directory and then follow the SSL configuration instructions in the product guide.
For client applications, you may only need to copy the CA certificate and configure the client to trust this certificate.
# 生成的文件位置在 [root@elastic-01 bin]# ls /usr/share/elasticsearch/ bin elastic-certificates.p12 elastic-stack-ca.p12 jdk lib LICENSE.txt modules NOTICE.txt plugins README.asciidoc
# 将文件放置/etc/elasticsearch/中 [root@elastic-01 elasticsearch]# mv elastic-* /etc/elasticsearch [root@elastic-01 elasticsearch]# ll /etc/elasticsearch/ total 48 -rw------- 1 root root 3443 Dec 11 23:32 elastic-certificates.p12 -rw-rw---- 1 root elasticsearch 199 Dec 11 22:42 elasticsearch.keystore -rw-rw---- 1 root elasticsearch 2891 Dec 11 22:58 elasticsearch.yml -rw------- 1 root root 2527 Dec 11 23:29 elastic-stack-ca.p12 -rw-rw---- 1 root elasticsearch 2373 May 12 2020 jvm.options drwxr-s--- 2 root elasticsearch 6 May 12 2020 jvm.options.d -rw-rw---- 1 root elasticsearch 17419 May 12 2020 log4j2.properties -rw-rw---- 1 root elasticsearch 473 May 12 2020 role_mapping.yml -rw-rw---- 1 root elasticsearch 197 May 12 2020 roles.yml -rw-rw---- 1 root elasticsearch 0 May 12 2020 users -rw-rw---- 1 root elasticsearch 0 May 12 2020 users_roles
# 设置密码，即为前面配置证书时输入的密码，漏此步骤，无法启动成功，会一直提示：failed to load SSL configuration [xpack.security.transport.ssl]
[root@elastic-01 elasticsearch]# /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password Enter value for xpack.security.transport.ssl.keystore.secure_password: [root@elastic-01 elasticsearch]# /usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password Enter value for xpack.security.transport.ssl.truststore.secure_password:
[root@elastic-01 elasticsearch]# /usr/share/elasticsearch/bin/elasticsearch-setup-passwords interactive Initiating the setup of passwords for reserved users elastic,apm_system,kibana,logstash_system,beats_system,remote_monitoring_user. You will be prompted to enter passwords as the process progresses. Please confirm that you would like to continue [y/N]y
Enter password for [elastic]: Reenter password for [elastic]: Enter password for [apm_system]: Reenter password for [apm_system]: Enter password for [kibana]: Reenter password for [kibana]: Enter password for [logstash_system]: Reenter password for [logstash_system]: Enter password for [beats_system]: Reenter password for [beats_system]: Enter password for [remote_monitoring_user]: Reenter password for [remote_monitoring_user]: Changed password for user [apm_system] Changed password for user [kibana] Changed password for user [logstash_system] Changed password for user [beats_system] Changed password for user [remote_monitoring_user] Changed password for user [elastic]
[root@elastic-01 elasticsearch]# pwd /etc/elasticsearch [root@elastic-01 elasticsearch]# openssl pkcs12 -in elastic-certificates.p12 -cacerts -nokeys -out elastic-ca.pem Enter Import Password: MAC verified OK [root@elastic-01 elasticsearch]# [root@elastic-01 elasticsearch]# ll total 52 -rw-r--r-- 1 root elasticsearch 1397 Dec 12 00:05 elastic-ca.pem -rw-r--r-- 1 elasticsearch elasticsearch 3443 Dec 11 23:32 elastic-certificates.p12 -rw-rw---- 1 root elasticsearch 335 Dec 11 23:49 elasticsearch.keystore -rw-rw---- 1 elasticsearch elasticsearch 3387 Dec 11 23:42 elasticsearch.yml -rw-r--r-- 1 elasticsearch elasticsearch 2527 Dec 11 23:29 elastic-stack-ca.p12 -rw-rw---- 1 elasticsearch elasticsearch 2373 May 12 2020 jvm.options drwxr-s--- 2 elasticsearch elasticsearch 6 May 12 2020 jvm.options.d -rw-rw---- 1 elasticsearch elasticsearch 17419 May 12 2020 log4j2.properties -rw-rw---- 1 elasticsearch elasticsearch 473 May 12 2020 role_mapping.yml -rw-rw---- 1 elasticsearch elasticsearch 197 May 12 2020 roles.yml -rw-rw---- 1 elasticsearch elasticsearch 0 May 12 2020 users -rw-rw---- 1 elasticsearch elasticsearch 0 May 12 2020 users_roles
# 将 elastic-ca.pem复制到kibana节点上/etc/kibana,略
配置kibana
安装nodejs，不然kibana有如下报错日志
1 2 3 4
Dec 21 01:07:50 localhost kibana: Browserslist: caniuse-lite is outdated. Please run the following command: `npm update` Dec 21 01:07:50 localhost kibana: Browserslist: caniuse-lite is outdated. Please run the following command: `npm update` Dec 21 01:07:50 localhost kibana: Browserslist: caniuse-lite is outdated. Please run the following command: `npm update` Dec 21 01:07:51 localhost kibana: Browserslist: caniuse-lite is outdated. Please run the following command: `npm update`
