Chrome 'Select a certificate'

Hi all,

I have no idea, why I am getting this popup in Google Chrome.

certificate

Than I click on Cancel and everything is working fine.

I am getting this popup only in Google Chrome.

Here is my elasticsearch.yml

cluster.name: elk
discovery.seed_hosts:
           - elk.tcluster.company.com
           - elk1.tcluster.company.com
           - elk2.tcluster.company.com
cluster.initial_master_nodes:
           - elk
           - elk1
           - elk2

### http and Cross-Origin Resource Sharing settings ###
http.cors.enabled: true
http.cors.allow-origin: /https?://(localhost(:[0-9]+)?|app(-[a-z]+)?\.companyapps(-np)?\.com)/
http.cors.allow-methods: OPTIONS, HEAD, GET, POST, PUT, DELETE
http.cors.allow-headers: X-Requested-With, X-Auth-Token, Content-Type, Content-Length, Authorization, Origin, Accept
http.cors.allow-credentials: true
http.max_content_length: 1000mb
indices.query.bool.max_clause_count: 1024



node.name: elk${NODEN}
node.master: true
node.data: true
node.ingest: true
bootstrap.memory_lock: true
node.max_local_storage_nodes: 1
path.data: /data/elasticsearch
path.logs: /var/log/elasticsearch
network.host: [_local_, _site_]
http.host: [_local_, _site_]

### open distro settings ###
opendistro_security.ssl.transport.pemcert_filepath: certificates/elk${NODEN}.pem
opendistro_security.ssl.transport.pemkey_filepath: certificates/elk${NODEN}.key
opendistro_security.ssl.transport.pemtrustedcas_filepath: certificates/CA.pem
opendistro_security.ssl.transport.enforce_hostname_verification: false
opendistro_security.ssl.http.enabled: true
opendistro_security.ssl.http.pemcert_filepath: certificates/elk${NODEN}.pem
opendistro_security.ssl.http.pemkey_filepath: certificates/elk${NODEN}.key
opendistro_security.ssl.http.pemtrustedcas_filepath: certificates/CA.pem
opendistro_security.allow_unsafe_democertificates: false
opendistro_security.authcz.admin_dn:
          - "CN=*.tcluster.company.com,O=Comp PR,C=CH"
opendistro_security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
opendistro_security.kerberos.krb5_filepath: '/etc/krb5.conf'
opendistro_security.kerberos.acceptor_keytab_filepath: 'keytab.keytab'
opendistro_security.kerberos.acceptor_principal: 'HTTP/elk${NODEN}.tcluster.company.com'
opendistro_security.ssl.transport.truststore_filepath: certificates/truststore.jks
opendistro_security.audit.type: internal_elasticsearch
opendistro_security.audit.config.index: security-auditlog
opendistro_security.nodes_dn:
        - "CN=elk.tcluster.company.com,O=Comp PR,C=CH"
        - "CN=elk1.tcluster.company.com,O=Comp PR,C=CH"
        - "CN=elk2.tcluster.company.com,O=Comp PR,C=CH"

For authetication I am using Kerberos and internal.
For authorization I am using LDAP.

Certificate authentication is off.

_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
    # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
    # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
    #filtered_alias_mode: warn
    #do_not_fail_on_forbidden: false
    #kibana:
    # Kibana multitenancy
    #multitenancy_enabled: true
    #server_username: kibanaserver
    #index: '.kibana'
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
        internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
        #internalProxies: '.*' # trust all internal proxies, regex pattern
        #remoteIpHeader:  'x-forwarded-for'
        ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
        ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
        ###### and here https://tools.ietf.org/html/rfc7239
        ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
    authc:
      kerberos_auth_domain:
        http_enabled: true
        transport_enabled: true
        order: 6
        http_authenticator:
          type: kerberos
          challenge: true
          config:
            # If true a lot of kerberos/security related debugging output will be logged to standard out
            krb_debug: false
            # If true then the realm will be stripped from the user name
            strip_realm_from_principal: true
        authentication_backend:
          type: noop

      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 4
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: intern

      proxy_auth_domain:
        description: "Authenticate via proxy"
        http_enabled: false
        transport_enabled: false
        order: 3
        http_authenticator:
          type: proxy
          challenge: false
          config:
            user_header: "x-proxy-user"
            roles_header: "x-proxy-roles"
        authentication_backend:
          type: noop

      jwt_auth_domain:
        description: "Authenticate via Json Web Token"
        http_enabled: false
        transport_enabled: false
        order: 0
        http_authenticator:
          type: jwt
          challenge: false
          config:
            signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
            jwt_header: "Authorization"
            jwt_url_parameter: null
            roles_key: null
            subject_key: null
        authentication_backend:
          type: noop

      clientcert_auth_domain:
        description: "Authenticate via SSL client certificates"
        http_enabled: false
        transport_enabled: false
        order: 2
        http_authenticator:
          type: clientcert
          config:
            username_attribute: cn #optional, if omitted DN becomes username
          challenge: false
        authentication_backend:
          type: noop

      ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: false
        transport_enabled: false
        order: 5
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
          type: ldap
          config:
            # enable ldaps
            enable_ssl: true
            # enable start tls, enable_ssl should be false
            enable_start_tls: false
            # send client certificate
            enable_ssl_client_auth: false
            # verify ldap hostname
            verify_hostnames: true
            hosts:
            - xyz.com:636
            bind_dn: 'CN=TECh,OU=TEC,OU=SpecialUser,DC=company,DC=dm,DC=com'
            password: password
            userbase: 'OU=Staff,DC=company,DC=dm,DC=com'
            # Filter to search for users (currently in the whole subtree beneath userbase)
            # {0} is substituted with the username
            usersearch: '(sAMAccountName={0})'
            # Use this attribute from the user as username (if not set then DN is used)
            username_attribute: null
    authz:
      roles_from_myldap:
        description: "Authorize via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        authorization_backend:
          # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
          type: ldap
          config:
            # enable ldaps
            enable_ssl: true
            # enable start tls, enable_ssl should be false
            enable_start_tls: false
            # send client certificate
            enable_ssl_client_auth: false
            # verify ldap hostname
            verify_hostnames: true
            hosts:
            - xyz.com:636
            bind_dn: 'CN=TECh,OU=TEC,OU=SpecialUser,DC=company,DC=dm,DC=com'
            password: password
            rolebase: "OU=Service,OU=CHR,OU=EMEA,OU=Groups,DC=company,DC=dm,DC=com"
            # Filter to search for roles (currently in the whole subtree beneath rolebase)
            # {0} is substituted with the DN of the user
            # {1} is substituted with the username
            # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
            rolesearch: '(member={0})'
            # Specify the name of the attribute which value should be substituted with {2} above
            userroleattribute: null
            # Roles as an attribute of the user entry
            userrolename: disabled
            #userrolename: memberOf
            # The attribute in a role entry containing the name of that role, Default is "name".
            # Can also be "dn" to use the full DN as rolename.
            rolename: cn
            # Resolve nested roles transitive (roles which are members of other roles and so on ...)
            resolve_nested_roles: true
            userbase: 'OU=Staff,DC=company,DC=dm,DC=com'
            # Filter to search for users (currently in the whole subtree beneath userbase)
            # {0} is substituted with the username
            usersearch: '(sAMAccountName={0})'
            # Skip users matching a user name, a wildcard or a regex pattern
            #skip_users:
            #  - 'cn=Michael Jackson,ou*people,o=TEST'
            #  - '/\S*/'
      roles_from_another_ldap:
        description: "Authorize via another Active Directory"
        http_enabled: false
        transport_enabled: false
        authorization_backend:
          type: ldap
          #config goes here ...
  #    auth_failure_listeners:
  #      ip_rate_limiting:
  #        type: ip
  #        allowed_tries: 10
  #        time_window_seconds: 3600
  #        block_expiry_seconds: 600
  #        max_blocked_clients: 100000
  #        max_tracked_clients: 100000
  #      internal_authentication_backend_limiting:
  #        type: username
  #        authentication_backend: intern
  #        allowed_tries: 10
  #        time_window_seconds: 3600
  #        block_expiry_seconds: 600
  #        max_blocked_clients: 100000
  #        max_tracked_clients: 100000

Could you please let me know what I am doing wrong?

Many thanks.

Issue has been resolved.

Added
opendistro_security.ssl.http.clientauth_mode: NONE