Edit

Fix failed Kibana authentication via self-signed certificates

Symptoms

Elasticsearch installation failed as shown below (10.1.1 HA):

error: {"error":{"root_cause":[{"type":"master_not_discovered_exception","reason":null}],"type":"master_not_discovered_exception","reason":null},"status":503}

Kibana tries to connect to ELK to acquire the xPACK license and receives a response about invalid certificates.

Resolution

To solve the issue, reinstall the existing ELK stack:

1. Stop the processes on all servers and remove the ELK applications:

   1. On the Master server, run the following commands:

      $ sudo su - WFUSER
      $ wfmanager stop logstash
      $ wfmanager stop elasticsearch
      
      $ cd INSTALL_DIR
      $ rm -rf elasticsearch
      $ rm -rf logstash
      

   2. On the Master server, run the following commands:

      $ sudo su - WFUSER
      $ wfmanager stop kibana
      
      $ cd INSTALL_DIR
      $ rm -rf kibana
      

2. Generate new certificates:

   1. On the Master server, go to the PACKAGE_DIR and remove the existing certificates:

      $ cd INSTALL_DIR/wf_installer
      
      $ rm -rf certificates/_auth_internal/elk-ca.*
      $ rm -rf certificates/_auth_internal/kibana.*
      $ rm -rf certificates/_auth_internal/logstash.*
      

   2. Create new certificates:

      ./install.sh certs generate
      

      The following certificates are created in the directory on the Master server:

      • elk-ca.crt
      • elk-ca.key
      • kibana.crt
      • kibana.key
      • logstash.crt
      • logstash.key
      • logstash.p12

3. Copy the new certificates to the /certificates directory on the Master server.

4. Run the script to reinstall Master servers according to the selected mode (HA or common) and installation method as described in the Install components topic. See the example below:

   $ ./install.sh preinstall master
   $ ./install.sh install master
   $ ./install.sh check master