Elastic Stack Certificate Exchange Suite

Automated Certificate Authority (CA) Generation, Certificate Renewal, Service Synchronization, and Multi-Server SCP Distribution for Elasticsearch, Kibana, and Fleet Server

Bash & Python Dual Implementation Single & Multi-Server Topology Automated Fleet Agent Sync
📁 Local Script Execution 🌐 Remote One-Liner (curl | python3)

⚡ Suite Architecture Overview

This suite provides end-to-end automation for renewing TLS/SSL certificates across Elasticsearch, Kibana, and Elastic Agent (Fleet Server). It supports both Single-Host Topologies (where ES and Kibana share a machine) and Multi-Host Topologies (where ES runs on Host 1 and Kibana + Elastic Agent run on Host 2 via SCP/SSH).

Single-Server Mode

Generates CA & node certs, extracts P12/PEM formats, sets permissions, updates kibana.yml CA fingerprint, restarts Elasticsearch and Kibana, and re-enrolls the local Elastic Agent.

Multi-Server Mode (SCP + SSH)

Runs on Elasticsearch host. Generates node certificates for both nodes, updates local ES, SCPs certs over to Kibana host, updates remote kibana.yml, and re-enrolls remote Elastic Agent over SSH.

🚀 Autopilot Zero-Touch Execution

Single one-liner that automatically parses configs, auto-detects single vs. multi-server topology, generates certificates, updates Kibana/ES, and re-enrolls Fleet Server Agent without prompting.

Single-Server Autopilot Execution

sudo ./autopilot-certs.py

Dual Elasticsearch Nodes Autopilot Execution (SCP + SSH to ES Node 2)

sudo ./autopilot-certs.py --es2-host 10.1.10.2

Multi-Server Autopilot (2x ES Nodes + Remote Kibana Host)

sudo ./autopilot-certs.py --es2-host 10.1.10.2 --kibana-host 10.1.10.4

🖥️ 1. Single-Server Workflow

Used when Elasticsearch, Kibana, and Elastic Agent (Fleet Server) run on the same server.

Propose Command & Inspect Configuration

./propose-cert-exchange.py --es-config /etc/elasticsearch/elasticsearch.yml --kibana-config /etc/kibana/kibana.yml

Execute Certificate Exchange (Proposer Auto-Run)

./propose-cert-exchange.py --execute

Direct Script Invocation with Environment Overrides

sudo ES_HTTP_P12_TARGET="/etc/elasticsearch/certs/http.p12" KIBANA_CRT_TARGET="/etc/kibana/certs/kibana.crt" FLEET_SERVER_ES_URL="https://10.1.10.3:9200" ./update-certs.py

🌐 2. Multi-Server Workflow (Local ES ➜ Remote Kibana via SCP/SSH)

Used when Elasticsearch runs on Host 1 (Local) and Kibana + Elastic Agent run on Host 2 (Remote).

Propose Multi-Server Distribution Command

./propose-cert-exchange-remote.py --kibana-host 10.1.10.4 --kibana-user root

Execute Multi-Server Exchange (Proposer Auto-Run)

./propose-cert-exchange-remote.py --kibana-host 10.1.10.4 --execute

Direct Script Invocation with Environment Overrides

sudo KIBANA_HOST="10.1.10.4" KIBANA_SSH_USER="root" FLEET_SERVER_ES_URL="https://10.1.10.3:9200" ./update-certs-remote.py

🔍 3. Certificate Expiry & Endpoint Inspection

Inspect expiry dates for all configured certificates and standard paths across the Elastic Stack.

./check-cert-expiry.py /etc/elasticsearch/elasticsearch.yml /etc/kibana/kibana.yml

📦 Included Script Index

File Name Type Description
autopilot-certs.py Python 3 Zero-touch autopilot certificate renewal & fleet sync script.
autopilot-certs.sh Bash Script Zero-touch autopilot certificate renewal shell entrypoint.
propose-cert-exchange.sh Bash Script Single-server config parser and cert exchange command proposer.
propose-cert-exchange.py Python 3 Python single-server parser with JSON output and CLI flags.
update-certs.sh Bash Script Single-server CA generation, cert extraction, and service sync.
update-certs.py Python 3 Python single-server cert renewal and Fleet Agent re-enrollment.
propose-cert-exchange-remote.sh Bash Script Multi-server command proposer for ES host ➜ Kibana host topology.
propose-cert-exchange-remote.py Python 3 Multi-server SSH/SCP proposer with remote config inspection.
update-certs-remote.sh Bash Script Multi-server cert renewal, SCP upload, remote update, and Agent enrollment.
update-certs-remote.py Python 3 Python multi-server SCP/SSH renewal and Agent enrollment orchestrator.
check-cert-expiry.sh Bash Script Inspects SSL certificate expiration dates on local server.
check-cert-expiry.py Python 3 Python SSL certificate expiration and path audit utility.