{"id":8893,"date":"2021-05-13T23:59:09","date_gmt":"2021-05-13T20:59:09","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8893"},"modified":"2024-03-18T22:28:40","modified_gmt":"2024-03-18T19:28:40","slug":"enable-kibana-https-connection","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/enable-kibana-https-connection\/","title":{"rendered":"Quick Way to Enable Kibana HTTPS Connection"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to enable Kibana HTTPS connection. HTTPS connections ensures that data is encrypted in transit.<\/p>\n\n\n\n<p>Kibana supports only TLS encryption protocol. With TLS, X.509 certificates are used to encrypt the data-in-transit.  This kind of encryption is asymetric because each certificate contains a public key and a\u2009private key which are used for cryptographic operations. Kibana supports certificates and private keys in PEM or PKCS#12 format.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Enabling Kibana HTTPS connection<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Install ELK Stack<\/h3>\n\n\n\n<p>Of course, you need to be having ELK or Kibana running to enable HTTPS.<\/p>\n\n\n\n<p>However, if you don&#8217;t already have ELK stack, you can use the guides in the links below;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-elastic-elk-stack-on-ubuntu-20-04\/\">Install ELK Stack on Ubuntu 20.04<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/installing-elk-stack-on-centos-8\/\">Installing ELK Stack on CentOS 8<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Enabling Kibana HTTPS connection<\/h3>\n\n\n\n<p>Once you have Kibana\/ELK installed, you can then proceed to enable Kibana with TLS\/SSL to enable you encrypt traffic between the browser and Kibana.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Obtain TLS Certificates and Private Key<\/h4>\n\n\n\n<p>You can choose to obtain a commercially trusted certificates and keys from an public CA of your preference.<\/p>\n\n\n\n<p>Similarly, you can use self-signed certificates for your non-public facing Kibana.<\/p>\n\n\n\n<p>If you opt to use the self-signed certificates, then there are two options. You can either obtain the TLS certs and key using;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"#openssl\" class=\"rank-math-link\">OpenSSL<\/a><\/li>\n\n\n\n<li><a href=\"#elasticsearch-util\" class=\"rank-math-link\">elasticsearch-certutil tool<\/a><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"openssl\">Generate Kibana Self Signed TLS Certs and Key using OpenSSL<\/h4>\n\n\n\n<p>To generate Kibana Self Signed TLS certs and key using <strong><code>openssl<\/code><\/strong>, run the commands below. <strong>Be sure to replace the respective details in your certificate<\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>mkdir \/etc\/ssl\/kibana<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl genrsa -out \/etc\/ssl\/kibana\/kibana-key.key 2048<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl req -new -x509 -sha512 -key \/etc\/ssl\/kibana\/kibana-key.key -out \/etc\/ssl\/kibana\/kibana-ca.crt -subj \"\/C=US\/ST=Utah\/L=Lehi\/O=Kifarunix-demo\/OU=IT\/CN=*.kifarunix-demo.com\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl req -new -key \/etc\/ssl\/kibana\/kibana-key.key -out \/etc\/ssl\/kibana\/kibana-ca.csr -subj \"\/C=US\/ST=Utah\/L=Lehi\/O=Kifarunix-demo\/OU=IT\/CN=*.kifarunix-demo.com\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl x509 -req -in \/etc\/ssl\/kibana\/kibana-ca.csr -CA \/etc\/ssl\/kibana\/kibana-ca.crt -CAkey \/etc\/ssl\/kibana\/kibana-key.key -CAcreateserial -sha512 -out \/etc\/ssl\/kibana\/kibana-cert.crt -days 3650<\/code><\/pre>\n\n\n\n<p>Set Kibana as the owner of the TLS certs and key;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>chown -R kibana: \/etc\/ssl\/kibana<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"elasticsearch-util\">Generate Kibana Self Signed TLS Certs using elasticsearch-certutil<\/h4>\n\n\n\n<p>If you don&#8217;t want to use OpenSSL to generate your Kibana TLS certs and key, then you can use the <strong><code>elasticsearch-certutil<\/code><\/strong> tool as follows.<\/p>\n\n\n\n<p>Create directory to store the certs files;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>mkdir \/etc\/ssl\/kibana<\/code><\/pre>\n\n\n\n<p>Generate the certs:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/usr\/share\/elasticsearch\/bin\/elasticsearch-certutil cert -name kibana-certs -dns localhost,*.kifarunix-demo.com -s<\/code><\/pre>\n\n\n\n<p>The command will generate a PKCS#12 file with the name you provided on the command line. However, it will prompt you to enter the certificate file name as well as whether to use the password.<\/p>\n\n\n\n<p>Sample output. For each, Press ENTER to choose default name provided\/blank password or provide the name\/password and press ENTER respectively.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Please enter the desired output file &#91;kibana-certs.p12]:\nEnter password for kibana-certs.p12 :<\/code><\/pre>\n\n\n\n<p>This places the cert file in the <code><strong>\/usr\/share\/elasticsearch\/<\/strong><\/code> with the name <strong>kibana-certs.p12<\/strong>.<\/p>\n\n\n\n<p>You can copy it to the directory created for the certs above;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cp \/usr\/share\/elasticsearch\/kibana-certs.p12 \/etc\/ssl\/kibana<\/code><\/pre>\n\n\n\n<p>Ensure <strong>Kibana<\/strong> user owns this file.<\/p>\n\n\n\n<pre id=\"block-0a37a6b8-41d7-4c50-bd8c-95ae0439c6ed\" class=\"wp-block-preformatted\">chown -R kibana: \/etc\/ssl\/kibana<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Enabling Kibana HTTPS Connection<\/h4>\n\n\n\n<h5 class=\"wp-block-heading\">Install TLS Certs in PEM format in Kibana<\/h5>\n\n\n\n<p>If you generated your certificates and keys using <strong>OpenSSL<\/strong>, then open Kibana configuration file, <strong><code>\/etc\/kibana\/kibana.yml<\/code><\/strong>, for editing and uncomment the lines;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>...\n#server.ssl.enabled: false\n#server.ssl.certificate: \/path\/to\/your\/server.crt\n#server.ssl.key: \/path\/to\/your\/server.key\n...\n#elasticsearch.ssl.certificateAuthorities: &#91; \"\/path\/to\/your\/CA.pem\" ]\n...<\/code><\/pre>\n\n\n\n<p>And update the paths to the generated certificate and key.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>vim \/etc\/kibana\/kibana.yml<\/code><\/pre>\n\n\n\n<p>Such that the line may look like;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>...\nserver.ssl.enabled: true\nserver.ssl.certificate: \/etc\/ssl\/kibana\/kibana-cert.crt\nserver.ssl.key: \/etc\/ssl\/kibana\/kibana-key.key\n...\n# Optional\nserver.ssl.certificateAuthorities: \/etc\/ssl\/kibana\/kibana-ca.crt\n...<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Install TLS Certs in PKCS#12 format in Kibana<\/h5>\n\n\n\n<p>If you generated your certificates and keys using <strong><code>elasticsearch-certutil<\/code><\/strong>, then open Kibana configuration file, <strong><code>\/etc\/kibana\/kibana.yml<\/code><\/strong>, for editing and uncomment the line <strong>#server.ssl.enabled: false<\/strong> and change the value to <strong>true<\/strong>.<\/p>\n\n\n\n<p>Also add the line, <strong><code>server.ssl.keystore.path: \"\/path\/to\/p12\/file\"<\/code><\/strong><\/p>\n\n\n\n<p>Simply run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo -e 'server.ssl.enabled: true\\nserver.ssl.keystore.path: \"\/etc\/ssl\/kibana\/kibana-certs.p12\"' &gt;&gt; \/etc\/kibana\/kibana.yml<\/code><\/pre>\n\n\n\n<p>If your certs is encrypted with a password, add the decryption password to your&nbsp;Kibana keystore by running the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>\/usr\/share\/kibana\/bin\/kibana-keystore add server.ssl.keyPassphrase<\/code><\/pre>\n\n\n\n<p>If you used an empty password, then enter the line, <strong><code>server.ssl.keystore.password: \"\"<\/code><\/strong>, in <strong>kibana.yml<\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo 'server.ssl.keystore.password: \"\"' &gt;&gt; \/etc\/kibana\/kibana.yml<\/code><\/pre>\n\n\n\n<p>Otherwise, you might experience such error,<strong><code> Error: PKCS#12 MAC could not be verified. Invalid password<\/code><\/strong>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Generate PEM Files from PKCS cert files<\/h4>\n\n\n\n<p>If you generated the PKCS file, you can generate the PEM files from it as follows;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Generate the CA certificate;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl pkcs12 -in \/etc\/ssl\/kibana\/kibana-certs.p12 -nodes -nokeys -cacerts -out \/etc\/ssl\/kibana\/kibana-ca.crt<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Generate the Certificate file;<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl pkcs12 -in  \/etc\/ssl\/kibana\/kibana-certs.p12 -out \/etc\/ssl\/kibana\/kibana-cert.crt -nokeys<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Generate the Key file<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>openssl pkcs12 -in \/etc\/ssl\/kibana\/kibana-certs.p12 -out \/etc\/ssl\/kibana\/kibana-key.key -nodes -nocerts<\/code><\/pre>\n\n\n\n<p>Once you have them in PEM format, change ownership to Kibana and can install them as shown above;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>chown -R kibana: \/etc\/ssl\/kibana<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Restart Kibana Service<\/h4>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart kibana<\/code><\/pre>\n\n\n\n<p>Check the logs to ensure Kibana is working fine.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Verify Kibana HTTPS configuration<\/h3>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>curl -sk -vvv \"https:\/\/elk.kifarunix-demo.com:5601\" --capath \/etc\/ssl\/kibana\/ 2&gt;&amp;1 | awk 'BEGIN { cert=0 } \/^* Server certificate:\/ { cert=1 } \/^*\/ { if (cert) print }'<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>* Server certificate:\n*  subject: C=US; ST=Utah; L=Lehi; O=Kifarunix-demo; OU=IT; CN=*.kifarunix-demo.com\n*  start date: May 25 18:52:15 2021 GMT\n*  expire date: May 23 18:52:15 2031 GMT\n*  issuer: C=US; ST=Utah; L=Lehi; O=Kifarunix-demo; OU=IT; CN=*.kifarunix-demo.com\n*  SSL certificate verify result: self signed certificate (18), continuing anyway.\n* Connection #0 to host elk.kifarunix-demo.com left intact<\/code><\/pre>\n\n\n\n<p>On the Browser, you can navigate to <strong>https:\/\/&lt;server-hostname&gt;:5601<\/strong><\/p>\n\n\n\n<p>When prompted, accept the self signed ssl warning and proceed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1700\" height=\"659\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/05\/kibana-https.png\" alt=\"Enable Kibana HTTPS Connection\" class=\"wp-image-8896\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/05\/kibana-https.png?v=1621976547 1700w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/05\/kibana-https-768x298.png?v=1621976547 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/05\/kibana-https-1536x595.png?v=1621976547 1536w\" sizes=\"(max-width: 1700px) 100vw, 1700px\" \/><\/figure>\n\n\n\n<p>And that concludes our guide on how to enable HTTPS connection.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Reference<\/h4>\n\n\n\n<p><a href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/configuring-tls.html\" target=\"_blank\" rel=\"noopener\">Configure Kibana to enable TLS<\/a><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Other Tutorials<\/h4>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/integrate-wazuh-manager-with-elk-stack\/\">Integrate Wazuh Manager with ELK Stack<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/configure-elk-stack-alerting-with-elastalert\/\">Configure ELK Stack Alerting with ElastAlert<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/visualize-wordpress-user-activity-logs-on-elk-stack\/\">Visualize WordPress User Activity Logs on ELK Stack<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to enable Kibana HTTPS connection. HTTPS connections ensures that data is encrypted in transit. Kibana supports only TLS<\/p>\n","protected":false},"author":3,"featured_media":8898,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[910,121,72,34],"tags":[3571,3573,166,920,3574,3572,3569,3570,3575],"class_list":["post-8893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-elastic-stack","category-howtos","category-monitoring","category-security","tag-configure-kibana-ssl-tls","tag-enable-kibana-ssl-tls-connection","tag-https","tag-kibana","tag-kibana-https","tag-kibana-self-signed-ssl","tag-kibana-ssl","tag-kibana-tls","tag-ssl-connection-kibana","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8893"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=8893"}],"version-history":[{"count":8,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8893\/revisions"}],"predecessor-version":[{"id":21818,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8893\/revisions\/21818"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/8898"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=8893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=8893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=8893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}