129 lines
5.1 KiB
Plaintext
129 lines
5.1 KiB
Plaintext
[role="xpack"]
|
||
[[tls-http]]
|
||
==== Encrypting HTTP client communications
|
||
|
||
When {security-features} are enabled, you can optionally use TLS to ensure that
|
||
communication between HTTP clients and the cluster is encrypted.
|
||
|
||
Enabling TLS on the HTTP layer is strongly recommended, but is not required.
|
||
|
||
IMPORTANT: In a <<dev-vs-prod-mode,production environment>>, some {es} features
|
||
such as tokens and API keys will be disabled unless you enable TLS on the HTTP
|
||
layer.
|
||
|
||
If you enable TLS on the HTTP layer in {es}, you might need to make
|
||
configuration changes in other parts of the Elastic Stack and in any {es}
|
||
clients that you use. For example, the following changes are typically
|
||
necessary:
|
||
|
||
* Update all clients, tools, and applications that connect to {es} to use the
|
||
`https` protocol in their configuration URL. For example, {kib}, {beats}, {ls},
|
||
language clients, and custom applications.
|
||
* Set trusted certificate authorities. This change is typically required only
|
||
if the {es} server certificate is issued by a certificate authority that is not
|
||
automatically trusted by the clients, tools, and applications that connect to
|
||
{es}.
|
||
|
||
If you enable advanced TLS features on {es} (such as
|
||
`ssl.client_authentication`), additional
|
||
configuration could be necessary, but is not typically required in most {es}
|
||
deployments.
|
||
|
||
. If you have not done so already, <<node-certificates,generate node certificates>>.
|
||
+
|
||
--
|
||
In particular, you need the files that are generated by the following command:
|
||
|
||
[source,shell]
|
||
----------------------------------------------------------
|
||
bin/elasticsearch-certutil http
|
||
----------------------------------------------------------
|
||
|
||
This command generates a zip file that contains certificates and keys for use in
|
||
{es} and {kib}. Each folder contains a readme that explains how to use the files.
|
||
--
|
||
|
||
. Verify that you've copied the output files to the appropriate locations, as
|
||
specified in the readme files.
|
||
+
|
||
--
|
||
For example, copy the `http.p12` file from the `elasticsearch` folder into a
|
||
directory within the {es} configuration directory on each node. If you chose to
|
||
generate one certificate per node, copy the appropriate `http.p12` file to each
|
||
node. If you want to use {kib} to access this cluster, copy the
|
||
`elasticsearch-ca.pem` file from the `kibana` folder into the {kib}
|
||
configuration directory.
|
||
--
|
||
|
||
. Enable TLS and specify the information required to access the node’s
|
||
certificate. For example:
|
||
|
||
.. Update the `elasticsearch.yml` file on each node with the location of the
|
||
certificates.
|
||
+
|
||
--
|
||
If the certificates are in PKCS#12 format:
|
||
|
||
[source, yaml]
|
||
--------------------------------------------------
|
||
xpack.security.http.ssl.enabled: true
|
||
xpack.security.http.ssl.keystore.path: "http.p12"
|
||
--------------------------------------------------
|
||
|
||
If you have certificates in PEM format:
|
||
|
||
[source, yaml]
|
||
--------------------------------------------------
|
||
xpack.security.http.ssl.enabled: true
|
||
xpack.security.http.ssl.key: /home/es/config/node1_http.key <1>
|
||
xpack.security.http.ssl.certificate: /home/es/config/node1_http.crt <2>
|
||
xpack.security.http.ssl.certificate_authorities: [ "/home/es/config/ca.crt" ] <3>
|
||
--------------------------------------------------
|
||
<1> The full path to the node key file. This must be a location within the
|
||
{es} configuration directory.
|
||
<2> The full path to the node certificate. This must be a location within the
|
||
{es} configuration directory.
|
||
<3> An array of paths to the CA certificates that should be trusted. These paths
|
||
must be a location within the {es} configuration directory.
|
||
--
|
||
|
||
.. If you secured the keystore or the private key with a password, add that password to a secure
|
||
setting in {es}.
|
||
+
|
||
--
|
||
If the certificates are in PKCS#12 format:
|
||
|
||
[source,shell]
|
||
-----------------------------------------------------------
|
||
bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
|
||
-----------------------------------------------------------
|
||
|
||
If the certificates are in PEM format:
|
||
|
||
[source,shell]
|
||
-----------------------------------------------------------
|
||
bin/elasticsearch-keystore add xpack.security.http.ssl.secure_key_passphrase
|
||
-----------------------------------------------------------
|
||
--
|
||
|
||
. Optional: If you want to use {kib}, follow the instructions in the readme
|
||
provided by the `elasticsearch-certutil http` command or see
|
||
{kibana-ref}/configuring-tls.html[Encrypting communications in {kib}].
|
||
|
||
. Restart {es}.
|
||
|
||
[NOTE]
|
||
===============================
|
||
* All TLS-related node settings are considered to be highly sensitive and
|
||
therefore are not exposed via the
|
||
{ref}/cluster-nodes-info.html#cluster-nodes-info[nodes info API] For more
|
||
information about any of these settings, see <<security-settings>>.
|
||
|
||
* {es} monitors all files such as certificates, keys, keystores, or truststores
|
||
that are configured as values of TLS-related node settings. If you update any of
|
||
these files (for example, when your hostnames change or your certificates are
|
||
due to expire), {es} reloads them. The files are polled for changes at
|
||
a frequency determined by the global {es} `resource.reload.interval.high`
|
||
setting, which defaults to 5 seconds.
|
||
===============================
|