Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

change to have kibana --ssl cli option use more recent certs #57933

Merged
merged 5 commits into from
Feb 28, 2020
Merged

change to have kibana --ssl cli option use more recent certs #57933

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
dd0e68d
change to have --ssl cli option use more recent certs
pmuellr Feb 18, 2020
fa7b00c
also configure 'server.ssl.certificateAuthorities' per PR review
pmuellr Feb 19, 2020
c10fb02
delete theoretically now-unused ssl creds
pmuellr Feb 19, 2020
fbcfd0f
Merge branch 'master' into kibana-dev/ssl-certs
elasticmachine Feb 26, 2020
7f3ac60
Merge branch 'master' into kibana-dev/ssl-certs
elasticmachine Feb 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions src/cli/serve/serve.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,6 @@ import { getConfigPath } from '../../core/server/path';
import { bootstrap } from '../../core/server';
import { readKeystore } from './read_keystore';

import { DEV_SSL_CERT_PATH, DEV_SSL_KEY_PATH } from '../dev_ssl';

function canRequire(path) {
try {
require.resolve(path);
Expand Down Expand Up @@ -90,7 +88,7 @@ function applyConfigOverrides(rawConfig, opts, extraCliOptions) {

if (opts.ssl) {
// @kbn/dev-utils is part of devDependencies
const { CA_CERT_PATH } = require('@kbn/dev-utils');
const { CA_CERT_PATH, KBN_KEY_PATH, KBN_CERT_PATH } = require('@kbn/dev-utils');
const customElasticsearchHosts = opts.elasticsearch
? opts.elasticsearch.split(',')
: [].concat(get('elasticsearch.hosts') || []);
Expand Down Expand Up @@ -121,10 +119,8 @@ function applyConfigOverrides(rawConfig, opts, extraCliOptions) {
});

set('server.ssl.enabled', true);
// TODO: change this cert/key to KBN_CERT_PATH and KBN_KEY_PATH from '@kbn/dev-utils'; will require some work to avoid breaking
// functional tests. Once that is done, the existing test cert/key at DEV_SSL_CERT_PATH and DEV_SSL_KEY_PATH can be deleted.
set('server.ssl.certificate', DEV_SSL_CERT_PATH);
set('server.ssl.key', DEV_SSL_KEY_PATH);
set('server.ssl.certificate', KBN_CERT_PATH);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
set('server.ssl.certificate', KBN_CERT_PATH);
set('server.ssl.certificateAuthorities', CA_CERT_PATH);
set('server.ssl.certificate', KBN_CERT_PATH);

Nit: This isn't required to make things work, but I would set the server.ssl.certificateAuthorities here. This ensures that the Kibana server will send the CA certificate to clients along with the server certificate.

Also you'd need to add another ensureNotDefined above for this setting.

Before and after Before: 
$ keytool -printcert -sslserver localhost:5601
Certificate #0
====================================
Owner: CN=kibana
Issuer: CN=Elastic Certificate Tool Autogenerated CA
Serial number: d356920f65ccd88ba8d90c16114a1dc5f26999aa
Valid from: Fri Dec 27 12:03:42 EST 2019 until: Sat Dec 14 12:03:42 EST 2069
Certificate fingerprints:
         SHA1: 10:A4:C7:7E:07:C4:9B:A0:A6:57:FD:70:78:7A:EE:BF:BD:CB:27:2C
         SHA256: 66:7B:31:92:7D:4F:68:C0:40:08:24:E3:9B:2B:7F:CD:D5:0F:8B:E6:13:0D:E5:FF:62:2B:B9:24:DF:65:46:1C
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 1A ED 26 0E 7B C3 46 70   5D 34 11 BC 0F 1C 0F 75  ..&...Fp]4.....u
0010: 60 2B 07 49                                        `+.I
]
]

#2: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
  CA:false
  PathLen: undefined
]

#3: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: localhost
]

#4: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 0B 07 51 28 DB 73 37 4A   CF 0C B0 56 B3 57 E4 F0  ..Q(.s7J...V.W..
0010: 71 BD CF 98                                        q...
]
]

After:

$ keytool -printcert -sslserver localhost:5601
Certificate #0
====================================
Owner: CN=kibana
Issuer: CN=Elastic Certificate Tool Autogenerated CA
Serial number: d356920f65ccd88ba8d90c16114a1dc5f26999aa
Valid from: Fri Dec 27 12:03:42 EST 2019 until: Sat Dec 14 12:03:42 EST 2069
Certificate fingerprints:
         SHA1: 10:A4:C7:7E:07:C4:9B:A0:A6:57:FD:70:78:7A:EE:BF:BD:CB:27:2C
         SHA256: 66:7B:31:92:7D:4F:68:C0:40:08:24:E3:9B:2B:7F:CD:D5:0F:8B:E6:13:0D:E5:FF:62:2B:B9:24:DF:65:46:1C
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 1A ED 26 0E 7B C3 46 70   5D 34 11 BC 0F 1C 0F 75  ..&...Fp]4.....u
0010: 60 2B 07 49                                        `+.I
]
]

#2: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
  CA:false
  PathLen: undefined
]

#3: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: localhost
]

#4: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 0B 07 51 28 DB 73 37 4A   CF 0C B0 56 B3 57 E4 F0  ..Q(.s7J...V.W..
0010: 71 BD CF 98                                        q...
]
]


Certificate #1
====================================
Owner: CN=Elastic Certificate Tool Autogenerated CA
Issuer: CN=Elastic Certificate Tool Autogenerated CA
Serial number: 5b46eb844b582b7b540589579d46be00c9805fa9
Valid from: Fri Dec 27 12:02:32 EST 2019 until: Sat Dec 14 12:02:32 EST 2069
Certificate fingerprints:
         SHA1: 86:5D:45:49:A1:18:5A:33:66:CD:01:40:A3:4D:2C:45:C1:60:7C:7B
         SHA256: AE:E4:15:52:63:D1:8B:E3:69:DB:BD:48:08:F0:E5:9D:55:2D:3E:F1:56:69:12:80:71:74:78:BF:E1:7D:BE:55
Signature algorithm name: SHA256withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

Extensions: 

#1: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 1A ED 26 0E 7B C3 46 70   5D 34 11 BC 0F 1C 0F 75  ..&...Fp]4.....u
0010: 60 2B 07 49                                        `+.I
]
]

#2: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

#3: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 1A ED 26 0E 7B C3 46 70   5D 34 11 BC 0F 1C 0F 75  ..&...Fp]4.....u
0010: 60 2B 07 49                                        `+.I
]
]

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

validated that my "before" looks like yours, before making the change ...

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and validated that my "after" also looks like yours

set('server.ssl.key', KBN_KEY_PATH);
set('elasticsearch.hosts', elasticsearchHosts);
set('elasticsearch.ssl.certificateAuthorities', CA_CERT_PATH);
}
Expand Down