From version 5.0 onward, Shield is part of X-Pack. For more information, see Securing the Elastic Stack.
« Shield with Elasticsearch for Apache Hadoop Setting up a CA »
Elastic Docs ›Shield - Elasticsearch Security Plugin [1.2]

Appendix 1. Running a Certificate Authority

edit

Appendix 1. Running a Certificate Authority

edit

A Certificate Authority (CA) can greatly simplify managing trust. Instead of trusting hundreds of certificates individually, a client only needs to trust the certificate from the CA. When the CA signs other node certificates, nodes that trust the CA also trust other nodes with certificates signed by the CA.

This procedure is an example of how to set up a CA and cannot universally address a wide array of security needs. To properly secure a production site, consult your organization’s security experts to discuss requirements.

To run a CA, generate a public and private key, and wrap the public key in a certificate that clients will trust.

Node certificates are sent in a Certificate Signing Request (CSR). Your CA signs the CSR, producing a newly signed certificate that you install on the node.

Because a Certificate Authority is a central point for trust, the private keys to the CA must be protected from compromise.

« Shield with Elasticsearch for Apache Hadoop Setting up a CA »