elasticsearch集群中修改为https

在原有的elasticsearch集群中修改为https

1.1.生成p12格式的CA证书

• 执行以下步骤

./bin/elasticsearch-certutil ca
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.

The 'ca' mode generates a new 'certificate authority'
This will create a new X.509 certificate and private key that can be used
to sign certificate when running in 'cert' mode.

Use the 'ca-dn' option if you wish to configure the 'distinguished name'
of the certificate authority

By default the 'ca' mode produces a single PKCS#12 output file which holds:

   * The CA certificate
     * The CA's private key

If you elect to generate PEM format certificates (the -pem option), then the output will
be a zip file containing individual files for the CA certificate and private key

Please enter the desired output file [elastic-stack-ca.p12]: <生成文件的名称，以p12为后缀>
Enter password for elastic-stack-ca.p12 :<输入CA证书密码>

• 获取到一个elastic-stack-ca.p12文件

1.2.生成p12格式的certificate证书

• 执行以下步骤

./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
............
If you specify any of the following options:
    * -pem (PEM formatted output)
    * -keep-ca-key (retain generated CA key)
    * -multiple (generate multiple certificates)
    * -in (generate certificates from an input file)
then the output will be be a zip file containing individual certificate/key files

Enter password for CA (elastic-stack-ca.p12) : <输入CA证书密码>
Please enter the desired output file [elastic-certificates.p12]: <生成文件名，以p12为后缀>
Enter password for elastic-certificates.p12 : <输入新证书密码>

Certificates written to /home/sandwich/app/elk/elasticsearch-7.17.1/elastic-certificates.p12

This file should be properly secured as it contains the private key for 
your instance.

This file is a self contained file and can be copied and used 'as is'
For each Elastic product that you wish to configure, you should copy
this '.p12' file to the relevant configuration directory
.............

• 获取到一个elastic-certificates.p12文件

1.3.生成pem格式的证书

$ openssl pkcs12 -in elastic-stack-ca.p12 -out ca.crt.pem -clcerts -nokeys
Enter Import Password:<输入对应证书密码>
MAC verified OK

1.4.修改elasticsearch配置

• 把elastic-certificates.p12 证书拷入到 Elasticsearch 安装目录下的config子目录

• 修改Elasticsearch的配置文件，config/elasticsearch.yml

  xpack.security.transport.ssl.enabled: true
  xpack.security.http.ssl.enabled: true
  xpack.security.authc.api_key.enabled: true
  xpack.security.http.ssl.keystore.path: elastic-certificates.p12
  xpack.security.http.ssl.truststore.path: elastic-certificates.p12
  xpack.security.http.ssl.keystore.password: <elastic-certificates.p12证书密码>
  xpack.security.http.ssl.truststore.password: <elastic-certificates.p12证书密码>
  

• 重启elasticsearc

1.5.配置Kibana

• 修改kibaba配置文件config/kibana.yml

  elasticsearch.ssl.certificateAuthorities: ["<1.3生成的pem文件的绝对路径>"]
  elasticsearch.ssl.verificationMode: none
  elasticsearch.hosts: ["https://localhost:9200"]
  

• 重启kibana