Edit

‎Fix failed Kibana authentication via self-signed certificates

Symptoms

Elasticsearch installation failed as shown below (10.1.1 HA):

error: {"error":{"root_cause":[{"type":"master_not_discovered_exception","reason":null}],"type":"master_not_discovered_exception","reason":null},"status":503}

Kibana tries to connect to ELK to acquire the xPACK license and receives a response about invalid certificates.

Resolution

To solve the issue, reinstall the existing ELK stack:

1. Stop the processes on all servers and remove the ELK applications:

   1. On the INT server, run the following commands:

      $ sudo su - WFUSER
      $ wfmanager stop logstash
      $ wfmanager stop elasticsearch
      
      $ cd INSTALL_DIR
      $ rm -rf elasticsearch
      $ rm -rf logstash
      

   2. On the APP server, run the following commands:

      $ sudo su - WFUSER
      $ wfmanager stop kibana
      
      $ cd INSTALL_DIR
      $ rm -rf kibana
      

2. Generate new certificates:

3. On the INT server, go to PACKAGE_DIR and remove the existing certificates:

   $ cd INSTALL_DIR/wf_installer
   
   $ rm -rf certificates/_auth_internal/elk-ca.*
   $ rm -rf certificates/_auth_internal/kibana.*
   $ rm -rf certificates/_auth_internal/logstash.*
   

4. Create new certificates:

   ./install.sh certs generate
   

   The following certificates will be created in the directory on the INT server:

   • elk-ca.crt
   • elk-ca.key
   • kibana.crt
   • kibana.key
   • logstash.crt
   • logstash.key
   • logstash.p12

5. Copy the new certificates to the /certificates directory on the APP server.

6. Run the script to reinstall the INT and APP servers, according to the selected mode (HA or common) and installation method as described in Install Intelligent Automation Cloud Enterprise. See the example below:

   $ ./install.sh preinstall int
   $ ./install.sh install int
   $ ./install.sh check int 
   
   $ ./install.sh preinstall app
   $ ./install.sh install app
   $ ./install.sh check app