Elasticsearch启动https访问

Elasticsearch上操作

前提:已设置密码访问

./bin/elasticsearch-certutil ca # 生成elastic-stack-ca.p12文件

./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 # 生成elastic-certificates.p12文件，供elasticsearch使用

openssl pkcs12 -in elastic-stack-ca.p12 -out newfile.crt.pem -clcerts -nokeys # 生成newfile.crt.pem文件，供kibana和filebeat使用，复制到各自对应目录下

./bin/elasticsearch-certutil cert --pem elastic-stack-ca.p12 # 生成certificate-bundle.zip文件，包含ca/ca.crt，instance/instance.crt，instance/instance.key
    Archive:  certificate-bundle.zip
       creating: ca/
      inflating: ca/ca.crt               
       creating: instance/
      inflating: instance/instance.crt   
      inflating: instance/instance.key 

elasticsearch.yml配置文件操作

xpack.security.enabled: true

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /home/vdb1/new_es/elasticsearch-7.3.0/config/elastic-certificates.p12
xpack.security.http.ssl.truststore.path: /home/vdb1/new_es/elasticsearch-7.3.0/config/elastic-certificates.p12

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /home/vdb1/new_es/elasticsearch-7.3.0/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /home/vdb1/new_es/elasticsearch-7.3.0/config/elastic-certificates.p12

kibana上操作

kibana.yml配置文件操作

elasticsearch.hosts: ["https://localhost:9200"] # 注意https
elasticsearch.ssl.verificationMode: none
elasticsearch.ssl.certificateAuthorities: ["/home/vdb1/new_es/kibana-7.3.0/config/newfile.crt.pem"]

elasticsearch.username: "kibana"
elasticsearch.password: "1io0K4VS7nkxpGwGwzHg"

filebeat上操作

filebeat.yml配置文件操作

注意：方法一和方法二使用的证书文件不一样，生成方式详见上述步骤

# 方法一
output.elasticsearch:
  hosts: ["localhost:9200"]
  protocol: "https"
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/home/vdb1/new_es/filebeat-7.3.0-linux-x86_64/newfile.crt.pem"]
  username: "elastic"
  password: "x8w2B6OcO3W"

# 方法二
output.elasticsearch:
  hosts: ["localhost:9200"]
  protocol: "https"
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/home/vdb1/new_es/filebeat-7.3.0-linux-x86_64/ca.crt"]
  username: "elastic"
  password: "x8w2B6ObcO3W"