Elasticsearch 无法获得颁发者证书

Question

我正在尝试使用 LetsEncrypt 加密 tls 证书。但我的服务器页面显示：Kibana server is not ready yet。

这是/etc/kibana/kibana.yml中的错误：

{"type":"log","@timestamp":"2022-05-29T09:48:26+00:00","tags":["error","elasticsearch-service"],"pid":476059,"message":"Unable to retrieve version information from Elasticsearch nodes. unable to get issuer certificate"}

我之前在自签名 CA 中使用了相同的配置，但它可以正常工作。但是当我切换到 LetsEncrypt 时，它不起作用。 Kibana 和 Elasticsearch 的 .pem 文件相同，都是从 /etc/letsencrypt/archive/my.exampledomain.com/ 复制而来的。

Elasticsearch 配置：

path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch

#network.host: 192.168.0.1
#network.host: localhost
#network.host: 0.0.0.0
network.host: [ _eth0_, _local_ ]

http.port: 9200

#discovery.seed_hosts: my.exampledomain.com
discovery.type: single-node
xpack.security.authc.api_key.enabled: true

xpack.security.enabled: true

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.verification_mode: certificate
xpack.security.http.ssl.key: /etc/elasticsearch/ssl/my.exampledomain.com/privkey2.pem
xpack.security.http.ssl.certificate: /etc/elasticsearch/ssl/my.exampledomain.com/cert2.pem
xpack.security.http.ssl.certificate_authorities: [ "/etc/elasticsearch/ssl/my.exampledomain.com/fullchain2.pem" ]

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: /etc/elasticsearch/ssl/my.exampledomain.com/privkey2.pem
xpack.security.transport.ssl.certificate: /etc/elasticsearch/ssl/my.exampledomain.com/cert2.pem
xpack.security.transport.ssl.certificate_authorities: [ "/etc/elasticsearch/ssl/my.exampledomain.com/fullchain2.pem" ]

Kibana 配置：

server.port: 5601

#server.host: "localhost"
#server.host: "my.exampledomain.com"
server.host: "0.0.0.0"

server.publicBaseUrl: "https://my.exampledomain.com"

#elasticsearch.hosts: ["http://localhost:9200"]
#elasticsearch.hosts: ["http://0.0.0.0:9200"]
elasticsearch.hosts: ["https://my.exampledomain.com:9200"]

elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/ssl/my.exampledomain.com/fullchain2.pem"]
elasticsearch.ssl.verificationMode: "certificate"
#elasticsearch.ssl.verify: true


xpack.security.sameSiteCookies: "None"
xpack.security.secureCookies: true

xpack.security.authc.providers:
  basic.basic1:
    order: 0

# Enable Kibana TLS over HTTPS

server.ssl.enabled: true
server.ssl.certificate: /etc/kibana/ssl/my.exampledomain.com/fullchain2.pem
server.ssl.key: /etc/kibana/ssl/my.exampledomain.com/privkey2.pem

Elasticsearch 测试： Elasticsearch server Response

Answer 1

我们遇到了类似的问题。它通过在链中包含每个步骤的证书来解决，包括 certificateAuthorities 属性中的根证书。

Elastic 似乎不需要的东西。