Fix failed Kibana authentication via self-signed certificates
Symptoms: Elasticsearch installation failed as shown below (10.1.1 HA).
error: {"error":{"root_cause":[{"type":"master_not_discovered_exception","reason":null}],"type":"master_not_discovered_exception","reason":null},"status":503}
Kibana tries to connect to ELK to acquire the xPACK license and receives a response about invalid certificates.
To solve the issue, reinstall the existing ELK stack:
Stop the processes on all servers and remove the ELK applications:
On the Master server, run the following commands:
$ sudo su - WFUSER
$ wfmanager stop logstash
$ wfmanager stop elasticsearch
$ cd INSTALL_DIR
$ rm -rf elasticsearch
$ rm -rf logstashOn the Master server, run the following commands:
$ sudo su - WFUSER
$ wfmanager stop kibana
$ cd INSTALL_DIR
$ rm -rf kibana
Generate new certificates:
On the Master server, go to the
PACKAGE_DIRand remove the existing certificates:$ cd INSTALL_DIR/wf_installer
$ rm -rf certificates/_auth_internal/elk-ca.*
$ rm -rf certificates/_auth_internal/kibana.*
$ rm -rf certificates/_auth_internal/logstash.*Create new certificates:
./install.sh certs generateThe following certificates are created in the directory on the Master server:
elk-ca.crtelk-ca.keykibana.crtkibana.keylogstash.crtlogstash.keylogstash.p12
Copy the new certificates to the
/certificatesdirectory on the Master server.Run the script to reinstall Master servers according to the selected mode (HA or common) and installation method as described in the Installation | Overview topic. See the example below:
$ ./install.sh preinstall master
$ ./install.sh install master
$ ./install.sh check master