# Ensure dependencies
apt update && apt install unzip jq -y

# The below part is relevant, if you have Elasticsearch running with HTTP
# Create certificate directory
mkdir -p /etc/elasticsearch/certs/

# Generate a CA certificate for Elasticsearch
/usr/share/elasticsearch/bin/elasticsearch-certutil ca

# Generate a certificate package for Elasticsearchs internal transport (not facing to users)
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /etc/elasticsearch/certs/elastic-stack-ca.p12

# Generate a HTTP certificate for Elasticsearch (user facing)
# Either as CSR to sign with your own Certificate Authority -or- self-signed from the above CA file
/usr/share/elasticsearch/bin/elasticsearch-certutil http

# Safely store the certificate file passwords to Elasticsearch, so it can open the files
# Transport
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
# HTTP
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.http.ssl.keystore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.http.ssl.truststore.secure_password