Describe the feature request
When kibana_tls: true, the role points server.ssl.certificate/key at
cert.pem/key.pem, but never generates them, so browser TLS only works if the
user brings their own certificate. Meanwhile the role generates
<hostname>-kibana.p12 (stack-CA signed) and copies it to /etc/kibana/certs/,
but nothing uses it.
Wanted: generate the browser certificate from the stack CA by default (so
kibana_tls works out of the box, like every other endpoint in the collection),
while keeping the option to bring your own via kibana_tls_cert/kibana_tls_key.
Scope: only the Kibana server/browser certificate (server.ssl). The
Kibana ↔ Elasticsearch side is separate (#486, 1.2.0).
Describe the feature request
When
kibana_tls: true, the role pointsserver.ssl.certificate/keyatcert.pem/key.pem, but never generates them, so browser TLS only works if theuser brings their own certificate. Meanwhile the role generates
<hostname>-kibana.p12(stack-CA signed) and copies it to/etc/kibana/certs/,but nothing uses it.
Wanted: generate the browser certificate from the stack CA by default (so
kibana_tlsworks out of the box, like every other endpoint in the collection),while keeping the option to bring your own via
kibana_tls_cert/kibana_tls_key.Scope: only the Kibana server/browser certificate (
server.ssl). TheKibana ↔ Elasticsearch side is separate (#486, 1.2.0).