# Elasticsearch not connecting to each other - Opendistro security not initialized

**URL:** <https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498>\
**Category:** Security\
**Created:** [November 1, 2021, 4:53pm UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498 "2021-11-01T16:53:20Z")\
**Posts on this page:** 7\
**Page:** 2

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 4, 2021, 3:59pm UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/21 "2021-11-04T15:59:23Z")

</div>

@shaimoh you can follow the documentation to generate the certs. Openssl can be also used in Windows environment.

> **[Generate Certificates](https://opendistro.github.io/for-elasticsearch-docs/docs/security/configuration/generate-certificates/)**
>
> Documentation for Open Distro, the community-driven, 100% open source distribution of Elasticsearch OSS with advanced security, alerting, deep performance analysis, and more.

---

<div class="post-metadata">

**Author:** ![shaimoh](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shaimoh](https://forum.opensearch.org/u/shaimoh)\
**Post date:** [November 5, 2021, 5:14pm UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/22 "2021-11-05T17:14:57Z")

</div>

Hi @pablo , Im still going in rounds.

Im not able to understand what exactly is the admin\_dn part is

opendistro\_security.authcz.admin\_dn:

- CN=kirk,OU=client,O=client,L=test, C=de

> what exactly is this CN and how is admin certificate different from node certificate  
> Am I supposed to give the elasticsearch url in the place of “kirk” here ? How to generate and define a CN here ?  
> Anything I should do in config.yml for the same ? Currently I havent done any changes in config.yml

Pls help…It would be a great help for me

---

<div class="post-metadata">

**Author:** ![shaimoh](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shaimoh](https://forum.opensearch.org/u/shaimoh)\
**Post date:** [November 16, 2021, 6:02am UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/23 "2021-11-16T06:02:55Z")

</div>

Hi @pablo , Hope you’re doing well

I tried with single node and it seems to be working and elasticsearch is coming up using HTTPS and shows secured however now the issue is with Kibana.

Im using the same certificates and root\_ca.pem and it says “Error: [config validation of [server].ssl.cert]: definition for this key is missing”

Below is my Kibana yml file . Can you check and advise if im doing anything wrong ? Im using the node certificates path

```auto

elasticsearch.hosts: https://CZASMV-MSELK003:9200
server.host: "CZASMV-MSELK003"
server.port: 5601
elasticsearch.ssl.verificationMode: none
server.ssl.cert: C:\opendistroforelasticsearch_kibana\config\CZASMV-MSELK003.pem
server.ssl.key: C:\opendistroforelasticsearch_kibana\config\CZASMV-MSELK003_key_pkcs8.pem
elasticsearch.ssl.certificateAuthorities: C:\OpenDistroForElasticsearchKibana\config\root_ca.pem
elasticsearch.username: admin
elasticsearch.password: admin
elasticsearch.requestHeadersWhitelist: ["securitytenant","Authorization"]

opendistro_security.multitenancy.enabled: true
opendistro_security.multitenancy.tenants.preferred: ["Private", "Global"]
opendistro_security.readonly_mode.roles: ["kibana_read_only"]

# Use this setting if you are running kibana without https
opendistro_security.cookie.secure: false

newsfeed.enabled: false
telemetry.optIn: false
telemetry.enabled: false
security.showInsecureClusterWarning: false
# To configure a WMS map server for use with Kibana, see:
# https://opendistro.github.io/for-elasticsearch-docs/docs/kibana/maptiles/
map.includeElasticMapsService: false

```

Thanks for your help

---

<div class="post-metadata">

**Author:** ![shaimoh](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shaimoh](https://forum.opensearch.org/u/shaimoh)\
**Post date:** [November 16, 2021, 6:03am UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/24 "2021-11-16T06:03:37Z")

</div>

This is the error

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/c/cf54753577e681ae2b65e548206493862ee85450.png)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 21, 2021, 11:20pm UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/25 "2021-11-21T23:20:19Z")

</div>

Hi @shaimoh

According to the provided error, definition for `server.ssl.cert` key doesn’t exist and that is correct. As per documentation, the valid key name is `server.ssl.certificate`.

> **[Configure TLS](https://opensearch.org/docs/latest/dashboards/install/tls/#configure-tls-for-opensearch-dashboards)**
>
> Configure TLS for OpenSearch Dashboards

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [November 21, 2021, 11:49pm UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/26 "2021-11-21T23:49:07Z")

</div>

@shaimoh in regards to yoru previous questions.  
opendistro\_security.authcz.admin\_dn lists all users who are allowed to execute admin tasks in the cluster using API requests (i.e. restore `.opendistro_security` index)

```auto
curl -k --cert ./kirk.pem --key ./kirk-key.pem -XPOST 'https://localhost:9200/_snapshot/my-repository/3/_restore?pretty'

```

To execute above command you’ll need client SSL certificate which will have following in settings.

- CN=kirk,OU=client,O=client,L=test, C=de

Furhter information in regards to DName’s elements you can find [here](https://docs.oracle.com/cd/E24191_01/common/tutorials/authz_cert_attributes.html)

The admin certificate is a client certificate. The main difference between client and node (server) certificate is that the client cert is used to authenticate the user/client (API calls to server) and server certificate validates server identity.  
Both certificates have different CN and SAN (subject alternative names) to match the server/client name.

You can compare the node and admin demo certs content by using the below commands.

```auto
openssl x509 -in <path_to_admin.cert> -text -noout

openssl x509 -in <path_to_server.cert> -text -noout

```

Hope this helps.

---

<div class="post-metadata">

**Author:** ![shaimoh](https://avatars.discourse-cdn.com/v4/letter/s/4da419/32.png) [@shaimoh](https://forum.opensearch.org/u/shaimoh)\
**Post date:** [November 30, 2021, 4:01am UTC](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498/27 "2021-11-30T04:01:22Z")

</div>

Hi @pablo

Thanks a lot for the clear information. Now I understood the difference.

Can this be added in the opendistro documentation. It would clearly solve lot of questions.

Thanks again for your help. Let me try getting a client certificate for my server

[Previous page](https://forum.opensearch.org/t/elasticsearch-not-connecting-to-each-other-opendistro-security-not-initialized/7498.md?page=1)