ssl - Windows 上的 Kibana SSL PEM 错误

Question

注意：我将在最终安装中重新生成所有密码和证书，因为我已在此处提供了所有这些信息。我也在这里问过同样的问题

https://discuss.elastic.co/t/kibana-ssl-pem-error-on-windows/117851/2

环境

Windows 10 企业版
弹性搜索版本：6.1.1 (elasticsearch-6.1.1.zip)
Kibana 版本：6.1.1 (kibana-6.1.1-windows-x86_64.zip)

问题： 我正在尝试在 kibana 中启用 SSL，但遇到了问题。我一生都无法弄清楚我做错了什么。这是我到目前为止所采取的步骤。

0) 使用 certutil--in标志创建 Yaml 文件。

instances:
  - name: node1
    dns: ['node1.local']
  - name: devws-kibana
    dns: ['devws-kibana.local']

1）声明用于powershell命令的变量

$root = "C:\working\elasticsearch"
[Version]$esVersion = "6.1.1"
$es = "$root\elasticsearch-$($esVersion.ToString())"
$esService = "elasticsearch_$($esVersion.ToString() -replace '\.','')"
[Version]$KibanaVersion = "6.1.1"
$kibana = "$root\kibana-$($KibanaVersion.ToString())-windows-x86_64"
$kibanaService = "elasticsearch-kibana$($KibanaVersion.ToString() -replace '\.','')"

2）在elasticsearch中安装x-pack

`&"$es\bin\elasticsearch-plugin.bat" install x-pack --batch`

3) 创建自签名 CA 证书。

 &"$es\bin\x-pack\certutil.bat" ca --silent --pass password --ca-dn "CN=Elasticsearch-DevWS" --pem --out "$root\elastic-stack-ca.zip"
    Expand-Archive -Path "$root\elastic-stack-ca.zip" -OutputPath "$root\certs"

4）为elasticsearch和kibana创建证书

&"$es\bin\x-pack\certutil.bat" cert --silent --pem --ca-cert "$root\certs\ca\ca.crt" --ca-key "$root\certs\ca\ca.key" -in "$root\instances.yml" --ca-pass password --pass password --out "$root\certificate-bundle.zip"
Expand-Archive -Path "$root\certificate-bundle.zip" -OutputPath "$root\certs"

5）将证书复制到正确的目录

Copy-Item -Path "$root\certs\ca\ca.crt" -Destination "$es\config\certs\ca.crt"
Copy-Item -Path "$root\certs\node1\*" -Destination "$es\config\certs\"
Copy-Item -Path "$root\certs\ca\ca.crt" -Destination "$kibana\config\certs\ca.crt"
Copy-Item -Path "$root\certs\devws-kibana\*" -Destination "$kibana\config\certs\"

6) 将 Elasticsearch.yml 更新到下面

cluster.name: WRK001
node.name: node1
network.host: node1.local
http.port: 9210
discovery.zen.ping.unicast.hosts: [ 'node1.local' ]
processors: 2
node.master: true
node.data: true
node.max_local_storage_nodes: 1
xpack.ssl.key: certs/node1.key
xpack.ssl.certificate: certs/node1.crt
xpack.ssl.certificate_authorities: certs/ca.crt
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: full
xpack.security.http.ssl.enabled: true
xpack.ssl.key_passphrase: password

7) 将安全密钥密码短语添加到密钥库

"password" |  &"$es\bin\elasticsearch-keystore.bat" add xpack.ssl.secure_key_passphrase --stdin
&"$es\bin\elasticsearch-keystore.bat" list

8) 启动 Elasticsearch

9) 为内置帐户设置密码

$url = https://node1.local:9210/
$output = & cmd.exe /C "$es\bin\x-pack\setup-passwords.bat auto --url $url -batch" 2>&1
Write-Host -ForegroundColor Green -BackgroundColor Black  $output

10) 从响应中解析密码并保存到临时文件。

$elasticPassword = ($output | Select-String -Pattern "^PASSWORD\selastic\s=\s(.*)$" -AllMatches).Matches[0].Groups[1].Value
$kibanaPassword = ($output | Select-String -Pattern "^PASSWORD\skibana\s=\s(.*)$" -AllMatches).Matches[0].Groups[1].Value
$elasticPassword | Out-File -FilePath "$es\config\elastic.password" -Encoding utf8
$kibanaPassword | Out-File -FilePath "$kibana\config\kibana.password" -Encoding utf8

11)xpack.ssl.key_passphrase从 Elasticsearch.yml中删除设置

12) 重启 Elasticsearch

13) 验证 Elasticsearch 是否有效（确实有效）

14）在kibana中安装X-Pack

&"$kibana\bin\kibana-plugin.bat" install x-pack

15) 更新 Kibana.yml 到下面

server.name: devws-kibana
server.host: devws-kibana.local
elasticsearch.url: https://node1.local:9210/
elasticsearch.username: kibana
elasticsearch.password: nWD0zPDLFiM3yHdVQM9j
elasticsearch.ssl.certificateAuthorities: ../config/certs/ca.crt

16) 启动 Kibana

17) 验证 Kibana 是否正在运行并且我能够使用弹性用户登录

18) 停止 Kibana

19) 更新 Kibana.yml 到下面

server.name: devws-kibana
server.host: devws-kibana.local
server.ssl.enabled: true
server.ssl.certificate: ../config/certs/devws-kibana.key
server.ssl.key: ../config/certs/devws-kibana.crt
elasticsearch.url: https://node1.local:9210/
elasticsearch.username: kibana
elasticsearch.password: nWD0zPDLFiM3yHdVQM9j
elasticsearch.ssl.certificateAuthorities: ../config/certs/ca.crt
xpack.security.encryptionKey: 3qrb1xee9ue9rrh3p93ykj28otgp676iu0l8ziifjopfov6h4sv9jhyp49gpm90t

20）尝试启动kibana。它失败并产生以下错误。

FATAL Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
    at Error (native)
    at Object.createSecureContext (_tls_common.js:69:17)
    at Server (_tls_wrap.js:776:25)
    at new Server (https.js:26:14)
    at Object.exports.createServer (https.js:47:10)
    at new module.exports.internals.Connection (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\node_modules\hapi\lib\connection.js:88:74)
    at internals.Server.connection (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\node_modules\hapi\lib\server.js:142:24)
    at KbnServer.exports.default (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\http\setup_connection.js:43:10)
    at C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:171:20
    at next (native)
    at step (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:87:191)
    at C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:87:437
    at C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:87:99
    at KbnServer.mixin (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\kbn_server.js:187:7)
    at KbnServer.<anonymous> (C:\working\elasticsearch\kibana-6.1.1-windows-x86_64\src\server\http\index.js:66:21)
    at next (native)

文档：

devws-kibana.key

devws-kibana.crt

ca.crt

score 0 · Accepted Answer

0

想通了这个问题。server.ssl.certificate 和 server.ssl.key 值已切换。

于 2018-01-31T23:45:56.143 回答

ssl - Windows 上的 Kibana SSL PEM 错误

1 回答 1

Related

Reference