Configuring SSL for OpenSearch

To set up SSL in OpenSearch, complete these steps in all the nodes of the OpenSearch cluster:

Note:

Keystore and Truststore files should be placed under the OS_HOME/config directory.

  1. Import the trusted root from Certification Authority (CA) and save it locally, for example, /home/certs/cacert.cer.

  2. Set up truststore and import trusted root certificate from CA to the truststore using JAVA_HOME/bin keytool.

    keytool -importcert -keystore OS_HOME/config/keystore/mytruststore.jks -file /home/certs/cacert.cer -alias my_ca

    When prompted, provide a password. This should be later encrypted and placed in the opensearch.yml configuration file.

    In steps 7, 8, and 9, when prompted whether you trust this certificate, enter Yes.

  3. Set up keystore and private key.

    keytool -genkey -alias node_alias -keystore OS_HOME/config/keystore/mykeystore.jks -keyalg RSA -keysize 2048 -validity 90

    When prompted, provide a password. This should be later encrypted and placed in the opensearch.yml configuration file.

    Enter details for the questions prompted on the screen.

    Enter key password for <node_alias> when prompted on the screen.

  4. Create Certificate Signing request (CSR).

    keytool -certreq -alias node_alias -keystore OS_HOME/config/keystore/mykeystore.jks -file /home/certs/mycsr.csr -keyalg rsa

    This step creates a CSR.

  5. Use the CSR to get a certificate from CA. Download it and save it locally, for example, /home/certs/signed.cer.

  6. Import the certificate to the Keystore. Use the same alias as the private key and certificate request.

    keytool -importcert -keystore OS_HOME/config/keystore/mykeystore.jks -file /home/certs/signed.cer -alias node_alias

  7. In the opensearch.yml configuration file, add these properties to set up SSL:

    Field or Control Description

    orclssl.http.ssl

    true

    orclssl.transport.ssl

    Set the property to true if you want to enable SSL in transport layer for node to node encryption. Enter false if you want to disable SSL in transport layer.

    orclssl.keystore

    <path to keystore>

    orclssl.keystore_password

    <keystore password>

    orclssl.truststore

    <path to truststore>

    orclssl.truststore_password

    <truststore password>

    orclssl.callback

    To set this property, refer to the Call Back Properties section in Creating Search Instances.

  8. Use the opensearchuser script to encrypt the keystore and truststore password. 

    OS_HOME/bin> opensearchuser encrypt [password]

  9. Use the encrypted password for the orclssl.keystore_password and orclssl.truststore_password in the opensearch.yml configuration file.

Note:

As both HTTP and HTTPS use the same channel, the port for HTTPS is the same as the one configured in http.port in the opensearch.yml configuration file. After SSL is enabled, the port configured for HTTP becomes HTTPS and HTTP will be disabled.