Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Graylog 7.0 + mongodb 8.x + opensearch/opensearch dashboards 2.19.4
unbuntu 24.04 virtual server
install made by apt package
Describe the issue:
one opensearch node but i will make a cluster later
Try to follow this link : Configuring TLS certificates - OpenSearch Documentation
Use my own corporate pki to configure opensearch in secure mode and i don’t understant all the process
i have a pfx, crt et key file
generate certificate by these commands :
openssl pkcs12 -in certificate.pfx -nokeys -out fullchain.pem
awk ‘BEGIN {c=0} /BEGIN CERTIFICATE/ {c++} c==1 {print}’ fullchain.pem > node.crt
awk ‘BEGIN {c=0} /BEGIN CERTIFICATE/ {c++} c>1 {print}’ fullchain.pem > ca.crt
openssl pkcs12 -in certificate.pfx -nocerts -out node_key_encrypted.pem
openssl rsa -in node_key_encrypted.pem -out node.key
chmod 644 \*.crt
chmod 600 node.key
chown -R opensearch:opensearch /etc/opensearch/*
Control the file* *.crt and key, everything seems to be allright (CA root+intermediate present)
Configuration:
cluster.name: graylog-cluster
node.name: ${HOSTNAME}
path.data: /opensearch_data/opensearch
path.logs: /opensearch_data/log
path.repo: /opensearch_data/snapshots
bootstrap.memory_lock: false
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: \[“xxxx”\]
#cluster.initial_cluster_manager_nodes: \[“xxxx”\]
reindex.remote.allowlist: \[“xxxx:9200”\]
plugins.security.disabled: true
plugins.security.allow_unsafe_democertificates: false
\---------------------------------- TLS -----------------------------------
#plugins.security.ssl.transport.enabled: false
#plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/config/certs/node.crt
#plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/config/certs/node.key
#plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/config/certs/ca.crt
#plugins.security.ssl.transport.enforce_hostname_verification: false
#plugins.security.ssl.transport.enable_openssl_if_available: true
\---------------------------------- HTTPS -----------------------------------
#plugins.security.ssl.http.enabled: false
#plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/config/certs/node.crt
#plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/config/certs/node.key
#plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/config/certs/ca.crt
#plugins.security.ssl.http.clientauth_mode: NONE
Relevant Logs or Screenshots:
When i activate ssl/tls and put false on plugins.security.disabled + plugin.security.ssl.transport.enabled= true & plugin.security.ssl.http.enabled = true. I have this issue on log :
mars 19 17:00:34 xxxxx systemd-entrypoint\[603609\]: Likely root cause: java.lang.RuntimeException: Demo certificates found \[25e34a9a5d4f1dceed1666eb624397bf3fe5787a7133cd32838ace0381bce1f7, ba9>
i’m stuck here now, i tried yesterday to move all demo certificates in /etc/opensearch/ inside a separate folder but no way, still this error shows.
Have already done this on elasticsearch 8.17.3 → ssl my own certificate and tls self signed certificate. Maybe i can do this with opensearch ?
Can someone help me to move forward ?
