證書生成工具（elasticsearch-certutil）
支持4種模式生成證書蔗包，下面以CA模式為例蒙保，
其他模式可參考https://blog.csdn.net/yi_qingjun/article/details/128742669
[root@ip elasticsearch]# bin/elasticsearch-certutil -h
Simplifies certificate creation for use with the Elastic Stack
Commands
--------
csr - generate certificate signing requests
cert - generate X.509 certificates and keys
ca - generate a new local certificate authority
http - generate a new certificate (or certificate request) for the Elasticsearch HTTP interface
Non-option arguments:
command
Option Description
------ -----------
-E <KeyValuePair> Configure a setting
-h, --help Show help
-s, --silent Show minimal output
-v, --verbose Show verbose output
生成CA證書
[root@ip elasticsearch]# bin/elasticsearch-certutil ca
生成p12密鑰
[root@ip elasticsearch]# bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
新增配置
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
##默認(rèn)讀config目錄下你稚，需要移動(dòng)文件且賦權(quán)
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
verification_mode配置方式支持三種：
full,認(rèn)證證書是否通過信任的CA證書簽發(fā)，同時(shí)認(rèn)證server的hostname 或者 IP 地址是否匹配證書中配置的
cretificate屉符，只認(rèn)證證書是否通過信任的CA證書簽發(fā)的
none篷角，什么也不認(rèn)證，相當(dāng)于關(guān)閉了SSL/TLS認(rèn)證冶伞，僅用于你非常相信的安全的環(huán)境
默認(rèn)情況下新症，elasticsearch-certutil生成的證書中沒有主機(jī)名信息。這意味著可以為集群中的任意節(jié)點(diǎn)使用此證書响禽，但是必須關(guān)閉主機(jī)名驗(yàn)證徒爹。
如果設(shè)置密碼，需要給各節(jié)點(diǎn)加上密碼
./bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
1輸入密碼：創(chuàng)建p12秘鑰設(shè)置的密碼（不是其他文章中提到的CAＳ罄唷Ｂ⌒帷！）侯繁，例如本樣例中的123456
./bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
1輸入密碼：創(chuàng)建p12秘鑰設(shè)置的密碼（不是其他文章中提到的CAＥ衷！Ｖ埂）丽焊，例如本樣例中的123456
重啟es集群
設(shè)置用戶密碼
./bin/elasticsearch-setup-passwords interactive
下面會(huì)要輸入很多密碼较剃，都要自己能記住，以后要用
需要設(shè)置 elastic,apm_system,kibana,kibana_system,logstash_system,beats_system,remote_monitoring_user.
docker-compose啟動(dòng)添加kibana環(huán)境變量
- ELASTICSEARCH_HOSTS=["http://ip:9200","http://ip:19200","http://ip:29200"]
- ELASTICSEARCH_USERNAME="kibana"
- ELASTICSEARCH_PASSWORD="123456"
至此完成es集群內(nèi)部安全通信技健，即9300端口通信加密
開啟es集群外部安全通信写穴，即9200端口通信加密
##新增配置
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.verification_mode: certificate
xpack.security.http.ssl.keystore.path: elastic-certificates.p12
xpack.security.http.ssl.truststore.path: elastic-certificates.p12
如果設(shè)置密碼，需要給各節(jié)點(diǎn)加上密碼
./bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
1輸入密碼：創(chuàng)建p12秘鑰設(shè)置的密碼（不是其他文章中提到的CA４萍０∷汀！）帽芽，例如本樣例中的123456
./bin/elasticsearch-keystore add xpack.security.http.ssl.truststore.secure_password
1輸入密碼：創(chuàng)建p12秘鑰設(shè)置的密碼（不是其他文章中提到的CAＩ鞠啤！５冀帧）披泪，例如本樣例中的123456
重啟es集群
現(xiàn)在需要通過https方式訪問
kibana相關(guān)配置
為kibana訪問es進(jìn)行配置（給kinbana生成pem）
[root@ip config]# openssl pkcs12 -in elastic-certificates.p12 -cacerts -nokeys -out elastic-ca.pem
Enter Import Password:p12秘鑰密碼
MAC verified OK
配置kibana
##需要賦權(quán)pem文件
elasticsearch.ssl.certificateAuthorities: [ "/usr/share/kibana/config/elastic-ca.pem" ]
elasticsearch.ssl.verificationMode: certificate
為kibana配置https，生成elastic-stack-ca.zip
[root@ip- elasticsearch]# bin/elasticsearch-certutil ca --pem
This tool assists you in the generation of X.509 certificates and certificate
signing requests for use with SSL/TLS in the Elastic stack.
The 'ca' mode generates a new 'certificate authority'
This will create a new X.509 certificate and private key that can be used
to sign certificate when running in 'cert' mode.
Use the 'ca-dn' option if you wish to configure the 'distinguished name'
of the certificate authority
By default the 'ca' mode produces a single PKCS#12 output file which holds:
* The CA certificate
* The CA's private key
If you elect to generate PEM format certificates (the -pem option), then the output will
be a zip file containing individual files for the CA certificate and private key
Please enter the desired output file [elastic-stack-ca.zip]:
對(duì)生成的elastic-stack-ca.zip進(jìn)行解壓搬瑰，生成ca.crt 和 ca.key
配置kibana
##需要賦權(quán)
server.ssl.enabled: true
server.ssl.certificate: config/ca.crt
server.ssl.key: config/ca.key
