基于Docker为Elasticsearch 9.0.1和Kibana 9.0.1配置SSL证书 保姆教程

一、证书生成流程
‌1. 进入容器/bin目录 创建CA证书

# --pass 参数设置密码保护证书文件， “” 不设置 密码
# 生成elastic-stack-ca.p12文件
elasticsearch-certutil ca --pass "" --out /usr/share/elasticsearch/config/certs/elastic-stack-ca.p12

2. 进入容器/bin目录 生成节点证书

# 生成elastic-certificates.p12文件
elasticsearch-certutil cert \
  --ca /usr/share/elasticsearch/config/certs/elastic-stack-ca.p12 \
  --ip 127.0.0.1,<容器IP> \ #可以有多个ip，逗号隔开
  --dns localhost,elasticsearch,kibana
  --out /usr/share/elasticsearch/config/certs/elastic-certificates.p12

3. ‌部署证书文件‌ (本地单机单节点部署 可以忽略此步骤)

docker cp elasticsearch:/usr/share/elasticsearch/config/certs /Users/{yourhostname}/elasticsearch/config
chmod -R 644 /Users/{yourhostname}/elasticsearch/config/certs/

二、Elasticsearch配置
修改elasticsearch.yml：

xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elastic-certificates.p12
  truststore.path: certs/elastic-certificates.p12

三、Kibana配置
‌1. 从ES容器复制CA证书

docker cp elasticsearch:/usr/share/elasticsearch/config/certs/elastic-stack-ca.p12 /Users/{yourhostname}/kibana/config/

2. 修改kibana.yml

elasticsearch.hosts: ["https://elasticsearch:9200"]
elasticsearch.ssl.certificateAuthorities: ["/usr/share/kibana/config/elastic-stack-ca.p12"]
server.ssl.enabled: true
server.ssl.certificate: /usr/share/kibana/config/elastic-certificates.p12

四、启动验证
1‌.重启服务

docker restart elasticsearch && sleep 20 && docker restart kibana

2.检查HTTPS访问

curl -u admin:admin123 https://localhost:9200

3. ‌访问Kibana界面
   浏览器访问https://localhost:5601，需导入CA证书并信任连接