Certificates deployment

SSL certificates are required to secure communication between Wazuh components and verify the identity of participating nodes. The Wazuh certificates tool is a utility that automates the generation of the SSL/TLS certificates required for a Wazuh deployment, including the root Certificate Authority (CA), node certificates, and administrative certificates. The installation guide uses the Wazuh certificates tool to create certificates, but any certificate generation method, such as OpenSSL, can be used.

Download the Wazuh certificates tool and save it as wazuh-certs-tool.sh in a working directory.

There are three kinds of certificates needed for the installation:

• root-ca: This certificate is the one in charge of signing the rest of the certificates.

• node: The node certificates are the ones needed for every Wazuh indexer node. They must include the node IP address.

• admin: The admin certificate is a client certificate with special privileges needed for management and security-related tasks.

The node and admin certificates are created with the following additional information. The root CA has only the L, O, and OU values:

• C: US

• L: California

• O: Wazuh

• OU: Wazuh

• CN: Name of the node

Save the config.yml template in the same directory as wazuh-certs-tool.sh, because the tool reads config.yml from its own directory. Edit config.yml and replace the node names and IP values with the corresponding names and IP addresses to create the SSL certificates. The <indexer-node-ip>, <wazuh-manager-ip>, and <dashboard-node-ip> values can be either IP addresses or DNS names. The Wazuh config.yml template can be downloaded here.

nodes:
  # Wazuh indexer nodes
  indexer:
    - name: indexer
      ip: "<indexer-node-ip>"
    #- name: indexer-2
    #  ip: "<indexer-node-ip>"
    #- name: indexer-3
    #  ip: "<indexer-node-ip>"

  # Wazuh manager nodes
  # If there is more than one Wazuh manager
  # node, each one must have a node_type
  manager:
    - name: manager
      ip: "<wazuh-manager-ip>"
    #  node_type: master
    #- name: manager-2
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker
    #- name: manager-3
    #  ip: "<wazuh-manager-ip>"
    #  node_type: worker

  # Wazuh dashboard nodes
  dashboard:
    - name: dashboard
      ip: "<dashboard-node-ip>"

  # ip and dns both accept a list, for a node reachable at more than one address.
  # Every item reaches the certificate of the node; the first one is the address
  # the components are configured with.
  #- name: manager-2
  #  ip:
  #    - "<wazuh-manager-ip>"
  #    - "<wazuh-manager-second-ip>"
  #  dns:
  #    - "<wazuh-manager-name>"

  # Optional. Only for a proxy that TERMINATES the agents' TLS session: it issues the
  # certificate that proxy serves, from the same root-ca the agents pin. A layer 4
  # passthrough load balancer terminates nothing and needs --agent-san with its
  # address instead, so that address reaches the listener certificate of every
  # manager node.
  #load_balancer:
  #  - name: lb
  #    dns:
  #      - "<load-balancer-name>"
  #    ip:
  #      - "<load-balancer-ip>"

Run the wazuh-certs-tool.sh script with the option -A to generate all the certificates after configuring the config.yml file.

# bash wazuh-certs-tool.sh -A

After running the script, the directory wazuh-certificates will be created and will have the following content:

wazuh-certificates/
├── admin-key.pem
├── admin.pem
├── dashboard-key.pem
├── dashboard.pem
├── indexer-key.pem
├── indexer.pem
├── manager-apid-key.pem
├── manager-apid.pem
├── manager-key.pem
├── manager-remoted-key.pem
├── manager-remoted.pem
├── manager.pem
└── root-ca.pem

The script also creates a wazuh-ca directory next to it, with the root CA certificate and its key. Back up this directory: you need it to add nodes or renew certificates.

Additionally, this script allows the use of a pre-existing rootCA certificate. To use it, place root-ca.pem and root-ca.key in the wazuh-ca directory next to the script, then run the script with option -A. The script reads the root CA from that directory, or from the directory set in WAZUH_CA_DIR:

# install -d -m 0700 -o root -g root wazuh-ca
# install -m 0644 -o root -g root /path/to/root-ca.pem wazuh-ca/root-ca.pem
# install -m 0400 -o root -g root /path/to/root-ca.key wazuh-ca/root-ca.key
# bash wazuh-certs-tool.sh -A

After running the script, the directory wazuh-certificates will be created and will have the following content:

wazuh-certificates/
├── admin-key.pem
├── admin.pem
├── dashboard-key.pem
├── dashboard.pem
├── indexer-key.pem
├── indexer.pem
├── manager-apid-key.pem
├── manager-apid.pem
├── manager-key.pem
├── manager-remoted-key.pem
├── manager-remoted.pem
├── manager.pem
└── root-ca.pem

WAZUH_DASHBOARD_CERT_SANS=<DNS_NAME>,<IP_ADDRESS>

# rm /etc/wazuh-dashboard/certs/dashboard.pem /etc/wazuh-dashboard/certs/dashboard-key.pem
# /usr/share/wazuh-dashboard/bin/resolve-credentials --install
# systemctl restart wazuh-dashboard