Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch - 2.3.0
OS - Linux (ubuntu 18.04)
Hi @all,
we are trying to configure Opensearch-Dashboard with self signed SSL certificate for opensearch.
Describe the issue:
OpenSearch config location: /home/aiml/opensearch-2.3.0/bin
OpenSearch dashboard config location: /home/aiml/opensearch-dashboards-2.3.0/bin
Opensearch is working fine with these SSL related files.
Curl status for opensearch:
{
“name” : “CNAS-AIML”,
“cluster_name” : “opensearch”,
“cluster_uuid” : “gWx3JHPeQOWZW1llka_6tA”,
“version” : {
“distribution” : “opensearch”,
“number” : “2.3.0”,
“build_type” : “tar”,
“build_hash” : “6f6e84ebc54af31a976f53af36a5c69d474a5140”,
“build_date” : “2022-09-09T00:07:12.137133581Z”,
“build_snapshot” : false,
“lucene_version” : “9.3.0”,
“minimum_wire_compatibility_version” : “7.10.0”,
“minimum_index_compatibility_version” : “7.0.0”
},
}
We are trying to configure the OpenSearch-dashboard with this SSL certificate files.
Configuration:
Here is the opensearch-dashboard configuration.
server.port: 5601
server.host: “0.0.0.0”
opensearch.hosts: [https://localhost:9200]
opensearch.username: “admin”
opensearch.password: “Accenture@123”
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
opensearch.ssl.verificationMode: full
server.ssl.enabled: true
server.ssl.certificate: /home/aiml/opensearch-2.3.0/config/node1.pem
server.ssl.key: /home/aiml/opensearch-2.3.0/config/node1-key.pem
opensearch.ssl.certificateAuthorities: [ “/home/aiml/opensearch-2.3.0/config/root-ca.pem” ]
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.cookie.secure: true
After execute the /bin/opensearch-dashboards, this error is generated.
aiml@CNAS-AIML:~/opensearch-dashboards-2.3.0/bin$ ./opensearch-dashboards
- log [09:21:20.879] [info][plugins-service] Plugin “visTypeXy” is disabled.*
- log [09:21:20.887] [info][plugins-service] Plugin “wizard” is disabled.*
- log [09:21:20.936] [warning][config][deprecation] “opensearch.requestHeadersWhitelist” is deprecated and has been replaced by “opensearch.requestHeadersAllowlist”*
- log [09:21:21.067] [info][plugins-system] Setting up [46] plugins: [alertingDashboards,usageCollection,opensearchDashboardsUsageCollection,opensearchDashboardsLegacy,mapsLegacy,share,opensearchUiShared,expressions,data,home,console,apmOss,management,indexPatternManagement,advancedSettings,savedObjects,securityDashboards,indexManagementDashboards,anomalyDetectionDashboards,queryWorkbenchDashboards,notificationsDashboards,reportsDashboards,charts,legacyExport,embeddable,dashboard,visualizations,visTypeTimeseries,visTypeVislib,visTypeVega,visTypeTimeline,timeline,visTypeMarkdown,visTypeTagcloud,visTypeTable,visTypeMetric,tileMap,regionMap,customImportMapDashboards,inputControlVis,observabilityDashboards,ganttChartDashboards,visualize,discover,savedObjectsManagement,bfetch]*
- log [09:21:21.626] [info][savedobjects-service] Waiting until all OpenSearch nodes are compatible with OpenSearch Dashboards before starting saved objects migrations…*
- log [09:21:21.663] [error][data][opensearch] [ConnectionError]: self signed certificate*
- log [09:21:21.670] [error][savedobjects-service] Unable to retrieve version information from OpenSearch nodes.*
- log [09:21:24.161] [error][data][opensearch] [ConnectionError]: self signed certificate*
- log [09:21:26.662] [error][data][opensearch] [ConnectionError]: self signed certificate*
- log [09:21:29.164] [error][data][opensearch] [ConnectionError]: self signed certificate*
When we change the configuration to this state:
server.port: 5601
server.host: “0.0.0.0”
opensearch.hosts: [https://localhost:9200]
opensearch.username: “admin”
opensearch.password: “Accenture@123”
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
opensearch.ssl.verificationMode: none
server.ssl.enabled: true
server.ssl.certificate: /home/aiml/opensearch-2.3.0/config/node1.pem
server.ssl.key: /home/aiml/opensearch-2.3.0/config/node1-key.pem
opensearch.ssl.certificateAuthorities: [ “/home/aiml/opensearch-2.3.0/config/root-ca.pem” ]
opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
opensearch_security.readonly_mode.roles: [kibana_read_only]
opensearch_security.cookie.secure: true
On starting the OpenSearch-Dashboard, getting this error.
Web UI is working
Now OpenSearch dashboard is open with SSL.
Can anyone please help me for how to use full instead of none mode for “opensearch.ssl.verificationMode” Here.
If anyone could point me in the right direction that would be great help.
@pablo
Thanks
