[DOCS] Adds certutil http command to TLS setup steps #51241

lcawl · 2020-01-20T20:28:40Z

Related to #49827

This PR updates the instructions in https://www.elastic.co/guide/en/elasticsearch/reference/master/configuring-tls.html#tls-http to take the new elasticsearch-certutil http command into consideration.

Preview: http://elasticsearch_51241.docs-preview.app.elstc.co/guide/en/elasticsearch/reference/master/configuring-tls.html

elasticmachine · 2020-01-20T20:28:42Z

Pinging @elastic/es-docs (>docs)

elasticmachine · 2020-01-20T20:28:44Z

Pinging @elastic/es-security (:Security/Network)

lcawl · 2020-01-20T22:08:02Z

@elasticmachine run elasticsearch-ci/docs

jkakavas · 2020-01-21T05:31:47Z

x-pack/docs/en/security/securing-communications/tls-http.asciidoc


-** If the certificate is in PEM format, add the following information to the
+If you did not use the `elasticsearch-certutil http` command and you have


Using elasticsearch-certutil http doesn't necessarily mean they did not end up with a PEM file. For instance, they could have used elasticsearch-certutil http to generate a CSR that they then took to their CA to sign and get back a PEM encoded certificate

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

x-pack/docs/en/security/securing-communications/node-certificates.asciidoc

Co-Authored-By: Ioannis Kakavas <[email protected]>

…tes.asciidoc Co-Authored-By: Ioannis Kakavas <[email protected]>

lcawl · 2020-01-21T21:05:16Z

@elasticmachine run elasticsearch-ci/bwc

lcawl · 2020-01-22T18:26:40Z

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

 [source, yaml]
 --------------------------------------------------
 xpack.security.http.ssl.enabled: true
-xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 <1>
-xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 <2>


@tvernum I noticed that the output from the elasticsearch-certutil http command did not mention setting the truststore.path, so I've removed it here too. If it's still required, let me know and I'll re-add it.

It's not required.

Technically, setting a truststore would configure which certificates the server would trust if we had clientAuthentication enabled (PKI). We don't need that.

It's also used by setup-passwords, but if no truststore is configured, it will assume that the keystore has the correct certificates and trust that, so it all works without needing any special config.

Great, thanks!

lcawl · 2020-01-22T18:36:49Z

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

 [source, yaml]
 --------------------------------------------------
 xpack.security.http.ssl.enabled: true
-xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 <1>
-xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 <2>
+xpack.security.http.ssl.keystore.path: "http.p12"


I think that since we talked about using a certs folder in previous examples, it should be used here too:

Suggested change

xpack.security.http.ssl.keystore.path: "http.p12"

xpack.security.http.ssl.keystore.path: certs/http.p12

Maybe we should drop the certs/ part entirely?
We don't use it in the PEM examples (and that uses more files)

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

tvernum · 2020-01-24T06:11:59Z

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

 [source, yaml]
 --------------------------------------------------
 xpack.security.http.ssl.enabled: true
-xpack.security.http.ssl.keystore.path: certs/elastic-certificates.p12 <1>
-xpack.security.http.ssl.truststore.path: certs/elastic-certificates.p12 <2>


It's not required.

Technically, setting a truststore would configure which certificates the server would trust if we had clientAuthentication enabled (PKI). We don't need that.

It's also used by setup-passwords, but if no truststore is configured, it will assume that the keystore has the correct certificates and trust that, so it all works without needing any special config.

Co-Authored-By: Tim Vernum <[email protected]>

lcawl · 2020-01-24T18:04:22Z

@elasticmachine update branch

x-pack/docs/en/security/securing-communications/node-certificates.asciidoc

jkakavas · 2020-02-03T19:22:35Z

x-pack/docs/en/security/securing-communications/node-certificates.asciidoc

+
+--
+Copy the applicable `.p12` files into the {es} configuration directory on each
+node. There is no need to copy the CA file to this directory.


There is no need to copy the CA file to this directory.

Not sure what we originally meant with this, I guess we assumed that the CA certificate is part of the PKCS#12 that we would create and then users wouldn't need to copy the CA certficate by itself in addition. In any case, I feel this makes assumptions on the setup and is not very helpful so why not take the opportunity to remove this sentence

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

…tes.asciidoc Co-Authored-By: Ioannis Kakavas <[email protected]>

Co-Authored-By: Ioannis Kakavas <[email protected]>

lcawl · 2020-02-13T07:07:52Z

@elasticmachine update branch

tvernum

Thanks Lisa.

x-pack/docs/en/security/securing-communications/tls-http.asciidoc

jkakavas

Apologies for the delay, this fell through the cracks

Co-Authored-By: Tim Vernum <[email protected]>

lcawl · 2020-02-21T17:05:30Z

@elasticmachine update branch

Co-Authored-By: Ioannis Kakavas <[email protected]> Co-Authored-By: Tim Vernum <[email protected]>

[DOCS] Adds certutil http command to TLS steps

6ecb50d

lcawl added >docs General docs changes :Security/TLS SSL/TLS, Certificates v8.0.0 v7.6.0 v7.7.0 labels Jan 20, 2020

jkakavas reviewed Jan 21, 2020

View reviewed changes

lcawl and others added 3 commits January 21, 2020 10:29

Update x-pack/docs/en/security/securing-communications/tls-http.asciidoc

de62baf

Co-Authored-By: Ioannis Kakavas <[email protected]>

Update x-pack/docs/en/security/securing-communications/node-certifica…

2a81dfd

…tes.asciidoc Co-Authored-By: Ioannis Kakavas <[email protected]>

[DOCS] Addresses feedback

f7fa7a0

lcawl marked this pull request as ready for review January 22, 2020 18:24

lcawl requested a review from tvernum January 22, 2020 18:24

lcawl commented Jan 22, 2020

View reviewed changes

tvernum reviewed Jan 24, 2020

View reviewed changes

lcawl and others added 2 commits January 24, 2020 08:40

[DOCS] Removes reference to certs folder in TLS instructions

7e56887

Update x-pack/docs/en/security/securing-communications/tls-http.asciidoc

66a23e4

Co-Authored-By: Tim Vernum <[email protected]>

Merge branch 'master' into tls-http

1c472ec

lcawl mentioned this pull request Jan 24, 2020

Clarify documentation for TLS encryption setup elastic/kibana#55739

Merged

jkakavas requested changes Feb 3, 2020

View reviewed changes

lcawl and others added 4 commits February 3, 2020 11:43

Update x-pack/docs/en/security/securing-communications/node-certifica…

5070d6a

…tes.asciidoc Co-Authored-By: Ioannis Kakavas <[email protected]>

Update x-pack/docs/en/security/securing-communications/tls-http.asciidoc

d6a9314

Co-Authored-By: Ioannis Kakavas <[email protected]>

[DOCS] Remove CA comment from node certificates

79673e2

[DOCS] Fixes PEM file names

176e459

Merge branch 'master' into tls-http

602156c

tvernum self-requested a review February 19, 2020 20:36

tvernum approved these changes Feb 21, 2020

View reviewed changes

x-pack/docs/en/security/securing-communications/tls-http.asciidoc Outdated Show resolved Hide resolved

jkakavas self-requested a review February 21, 2020 08:40

jkakavas approved these changes Feb 21, 2020

View reviewed changes

Update x-pack/docs/en/security/securing-communications/tls-http.asciidoc

5d6f8f4

Co-Authored-By: Tim Vernum <[email protected]>

Merge branch 'master' into tls-http

dda31ca

lcawl merged commit 01a6dae into elastic:master Feb 21, 2020

lcawl deleted the tls-http branch February 21, 2020 18:04

lcawl added a commit that referenced this pull request Feb 21, 2020

[DOCS] Adds certutil http command to TLS setup steps (#51241)

56efd8b

Co-Authored-By: Ioannis Kakavas <[email protected]> Co-Authored-By: Tim Vernum <[email protected]>

lcawl added a commit that referenced this pull request Feb 21, 2020

[DOCS] Adds certutil http command to TLS setup steps (#51241)

09b8a1f

Co-Authored-By: Ioannis Kakavas <[email protected]> Co-Authored-By: Tim Vernum <[email protected]>

lcawl added v7.6.1 and removed v7.6.0 labels Feb 21, 2020

jakelandis added v8.0.0-alpha1 and removed v8.0.0 labels Jul 26, 2021


		** If the certificate is in PEM format, add the following information to the
		If you did not use the `elasticsearch-certutil http` command and you have

	xpack.security.http.ssl.keystore.path: "http.p12"
	xpack.security.http.ssl.keystore.path: certs/http.p12

[DOCS] Adds certutil http command to TLS setup steps #51241

[DOCS] Adds certutil http command to TLS setup steps #51241

Uh oh!

Conversation

lcawl commented Jan 20, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticmachine commented Jan 20, 2020

Uh oh!

elasticmachine commented Jan 20, 2020

Uh oh!

lcawl commented Jan 20, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

lcawl commented Jan 21, 2020

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lcawl commented Jan 24, 2020

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

lcawl commented Feb 13, 2020

Uh oh!

tvernum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jkakavas left a comment

Choose a reason for hiding this comment

Uh oh!

lcawl commented Feb 21, 2020

Uh oh!

Uh oh!

lcawl commented Jan 20, 2020 •

edited

Loading