elasticsearch生成证书的两种方式

1.elasticsearch-certgen 方式
详细见文档：elasticsearch 集群安装 + xpack + es-head + ik分词
注意: 这种方式如果以后新增节点导致证书得重新生成并放到es所有节点

2.elasticsearch-certutil方式

##(1)创建证书
$ pwd
/alidata1/admin/tools/elasticsearch-6.8.6
$ ./bin/elasticsearch-certutil ca --pem --out ca.zip --days 36500 -s  ## 会生成ca.zip文件
$ unzip ca.zip 
$ openssl x509 -in ca/ca.crt -noout -dates    ## 查看证书有效期
notBefore=Jun  9 02:15:46 2020 GMT
notAfter=May 16 02:15:46 2120 GMT
$ ./bin/elasticsearch-certutil cert --ca-cert ca/ca.crt --ca-key ca/ca.key --pem --name za-test  --out za-test.zip --days 36500 -s            ## 会生成za-test.zip文件
$ unzip za-test.zip
$ openssl x509 -in za-test/za-test.crt -noout -dates   ## 查看证书有效期
notBefore=Jun  9 02:24:27 2020 GMT
notAfter=May 16 02:24:27 2120 GMT

##(2)将证书拷贝到对应目录
$ mkdir config/certs
$ cp ca/* za-test/* config/certs
##(3)将新证书拷贝到集群所有机器 
$ scp config/certs/* xxxx

##(3)修改配置
...
## ssl
xpack.security.transport.ssl.enabled: true
xpack.security.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.key: certs/za-test.key
xpack.security.transport.ssl.certificate: certs/za-test.crt
xpack.security.transport.ssl.certificate_authorities: certs/ca.crt
...

##(4)生成账户密码
$ ./bin/elasticsearch-setup-passwords interactive    ## 依次输入密码