<p>i am trying to setup basic authentication on elasticsearch. i found it's required to setup SSL certificate also.</p>
<p>Following this article : <a href="https://pimwiddershoven.nl/entry/deploy-a-secure-instance-of-elasticsearch-on-kubernetes" rel="nofollow noreferrer">https://pimwiddershoven.nl/entry/deploy-a-secure-instance-of-elasticsearch-on-kubernetes</a></p>
<p>Cluster is up and running on Kubernetes using helm</p>
<p>But when sending</p>
<pre><code>curl -H &quot;Authorization: Basic ZWxsdfasdfiojoijQw==&quot; https://localhost:9200
</code></pre>
<p>it's giving error like</p>
<pre><code>curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
</code></pre>
<p>but when sending request using <code>curl insecure</code> mode or with <code>-k</code> it's working fine and can see cluster health</p>
<p>it's due to self sign certificate. am i missing anything ?</p>
<p>Official helm chart also suggest same way to generate certificate and add into cluster.</p>
<p><a href="https://github.com/elastic/helm-charts/tree/master/elasticsearch/examples/security" rel="nofollow noreferrer">https://github.com/elastic/helm-charts/tree/master/elasticsearch/examples/security</a></p>
<p>Update :</p>
<pre><code>Elastic.yaml

protocol: https

esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.enabled: true
    xpack.security.http.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.http.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.authc.realms.native.local.order: 0

extraEnvs:
  - name: ELASTIC_PASSWORD
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: password
  - name: ELASTIC_USERNAME
    valueFrom:
      secretKeyRef:
        name: elastic-credentials
        key: username

secretMounts:
  - name: elastic-certificates
    secretName: elastic-certificates
    path: /usr/share/elasticsearch/config/certs
</code></pre>

chagan
<p>If you are trying to set HTTPS on Kubernetes svc and using it as DNS it won't work without <code>curl -k</code> or <code>--insecure</code></p>
<p>Unless and until you don't have proper DNS to and domain name to resolve it won't work you have to use insecure mode only.</p>
<p>use the proper domain name and generate a certificate it will work like charm.</p>
<p>However, for verification you can also do:</p>
<pre><code>curl --cacert $path_to_certificate https://host_ip:9200
</code></pre>
<p><strong>Easy Workaround</strong></p>
<p>You can use nginx in front of ES cluster and terminate SSL there and send HTTP request to ES. While your domain till nginx will have HTTPS SSL/TLS.</p>
<p><strong>If you just want basic auth (username/password) with HTTP only</strong></p>
<pre><code>esConfig:
  elasticsearch.yml: |
    xpack.security.enabled: true
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: /usr/share/elasticsearch/config/certs/elastic-certificates.p12
</code></pre>
