44<titleabbrev>Encrypting communications</titleabbrev>
55++++
66
7- {kib} supports Transport Layer Security (TLS/SSL) encryption for all forms of data-in-transit. Browsers send traffic to {kib} and {kib}
8- sends traffic to {es}. These communications are configured separately.
7+ {kib} supports Transport Layer Security (TLS/SSL) encryption for all forms of
8+ data-in-transit. Browsers send traffic to {kib} and {kib} sends traffic to {es}.
9+ These communications are configured separately.
910
1011[[configuring-tls-browser-kib]]
1112==== Encrypting traffic between the browser and {kib}
@@ -78,15 +79,18 @@ NOTE: To perform this step, you must
7879{ref}/configuring-security.html[enable the {es} {security-features}] or you
7980must have a proxy that provides an HTTPS endpoint for {es}.
8081
81- . Specify the HTTPS URL in the `elasticsearch.hosts` setting in the {kib} configuration file, `kibana.yml`:
82+ . Specify the HTTPS URL in the `elasticsearch.hosts` setting in the {kib}
83+ configuration file, `kibana.yml`:
8284+
8385--
8486[source,yaml]
8587--------------------------------------------------------------------------------
8688elasticsearch.hosts: ["https://<your_elasticsearch_host>.com:9200"]
8789--------------------------------------------------------------------------------
8890
89- Using the HTTPS protocol results in a default `elasticsearch.ssl.verificationMode` option of `full`, which utilizes hostname verification.
91+ Using the HTTPS protocol results in a default
92+ `elasticsearch.ssl.verificationMode` option of `full`, which utilizes hostname
93+ verification.
9094
9195For more information, see <<settings,{kib} configuration settings>>.
9296--
@@ -95,24 +99,32 @@ For more information, see <<settings,{kib} configuration settings>>.
9599+
96100--
97101
98- If you are using your own CA to sign certificates for {es}, then you need to specify the CA certificate chain in {kib} to properly establish
99- trust in TLS connections. If your CA certificate chain is contained in a PKCS #12 trust store, specify it like so:
102+ If you are using your own CA to sign certificates for {es}, then you need to
103+ specify the CA certificate chain in {kib} to properly establish trust in TLS
104+ connections. If your CA certificate chain is contained in a PKCS #12 trust store,
105+ specify it like so:
100106
101107[source,yaml]
102108--------------------------------------------------------------------------------
103109elasticsearch.ssl.truststore.path: "/path/to/your/truststore.p12"
104110elasticsearch.ssl.truststore.password: "optional decryption password"
105111--------------------------------------------------------------------------------
106112
107- Otherwise, if your CA certificate chain is in PEM format, specify each certificate like so:
113+ Otherwise, if your CA certificate chain is in PEM format, specify each
114+ certificate like so:
108115
109116[source,yaml]
110117--------------------------------------------------------------------------------
111118elasticsearch.ssl.certificateAuthorities: ["/path/to/your/cacert1.pem", "/path/to/your/cacert2.pem"]
112119--------------------------------------------------------------------------------
113120
121+ TIP: You can use the {ref}/certutil.html[`elasticsearch-certutil http` command]
122+ to generate a PEM format x.509 certificate for the {es} CA. It also provides
123+ detailed configuration details in readme files.
124+
114125--
115126
116- . (Optional) If the Elastic {monitor-features} are enabled, configure {kib} to connect to the {es} monitoring cluster via HTTPS. The steps
117- are the same as above, but each setting is prefixed by `xpack.monitoring.`. For example, `xpack.monitoring.elasticsearch.hosts`,
127+ . (Optional) If the Elastic {monitor-features} are enabled, configure {kib} to
128+ connect to the {es} monitoring cluster via HTTPS. The steps are the same as
129+ above, but each setting is prefixed by `xpack.monitoring.`. For example, `xpack.monitoring.elasticsearch.hosts`,
118130`xpack.monitoring.elasticsearch.ssl.truststore.path`, etc.
0 commit comments