Skip to main content

Fix failed Kibana authentication via self-signed certificates

Symptoms: Elasticsearch installation failed as shown below (10.1.1 HA).

error: {"error":{"root_cause":[{"type":"master_not_discovered_exception","reason":null}],"type":"master_not_discovered_exception","reason":null},"status":503}

Kibana tries to connect to ELK to acquire the xPACK license and receives a response about invalid certificates.

To solve the issue, reinstall the existing ELK stack:

  1. Stop the processes on all servers and remove the ELK applications:

    1. On the Master server, run the following commands:

      $ sudo su - WFUSER
      $ wfmanager stop logstash
      $ wfmanager stop elasticsearch

      $ cd INSTALL_DIR
      $ rm -rf elasticsearch
      $ rm -rf logstash
    2. On the Master server, run the following commands:

      $ sudo su - WFUSER
      $ wfmanager stop kibana

      $ cd INSTALL_DIR
      $ rm -rf kibana
  2.  Generate new certificates:

    1. On the Master server, go to the PACKAGE_DIR and remove the existing certificates:

      $ cd INSTALL_DIR/wf_installer

      $ rm -rf certificates/_auth_internal/elk-ca.*
      $ rm -rf certificates/_auth_internal/kibana.*
      $ rm -rf certificates/_auth_internal/logstash.*
    2. Create new certificates:

      ./install.sh certs generate

      The following certificates are created in the directory on the Master server:

      • elk-ca.crt
      • elk-ca.key
      • kibana.crt
      • kibana.key
      • logstash.crt
      • logstash.key
      • logstash.p12
  3. Copy the new certificates to the /certificates directory on the Master server.

  4. Run the script to reinstall Master servers according to the selected mode (HA or common) and installation method as described in the Installation | Overview topic. See the example below:

    $ ./install.sh preinstall master
    $ ./install.sh install master
    $ ./install.sh check master