PKCS #12 Certificates

[kobelb]

Customers are requesting PKCS #12 certificates in addition PEM certificates. We'll want to be able to add these for the Elasticsearch SSL connections, as well as the Kibana HTTPS server.

The following Kibana settings allow PEM encoded certificates to be specified:

• elasticsearch.ssl.certificate
• elasticsearch.ssl.key
• elasticsearch.ssl.certificateAuthorities
• server.ssl.certificate
• server.ssl.key
• server.ssl.certificateAuthorities

[jportner]

Looking at this now, seems doable with the pem module's readPkcs12 method -- that will allow us to extract the CA cert, instance cert, and instance private key separately.

The only caveat that I can see so far is that this module depends on OpenSSL being installed. It appears that this will work with Windows, but may require an environment variable set to point to the OpenSSL binary. I assume this will be acceptable (with appropriate error messages of course), as reading PKCS12 certificates will be an optional added feature that will not affect vanilla installs.

[kobelb]

I assume this will be acceptable (with appropriate error messages of course), as reading PKCS12 certificates will be an optional added feature that will not affect vanilla installs.

It's preferable for us to not have to depend on a shared library... we've historically run into a lot of issues with Reporting needing limited shared libraries. Have you already looked into and ruled out https://www.npmjs.com/package/node-forge as a potential option? NodeJS also has a bundled version of OpenSSL that they use internally, when I looked last I wasn't able to figure out how we could call it though.

[legrego]

NodeJS also has a bundled version of OpenSSL that they use internally, when I looked last I wasn't able to figure out how we could call it though.

I was just trying to figure this out. As far as I can tell, OpenSSL is statically linked into the Node.js executable. I think, if we want to take advantage of this, that we'd need to create/use a native module to communicate with OpenSSL outside of what the Node.js runtime provides.