1、建立ES集群
2、在任何一个节点创建一个ca，记住ca密码
bin/elasticsearch-certutil ca
3、拿ca文件到个节点创建基于ca的该主机的凭证，需要ca密码，并设置凭证密码
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
4、将证书密码添加到keystore，keystore不存在时用./bin/elasticsearch-keystore create创建
bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
5、将生成的凭证用主机名命名，放在${ES_HOME}/config/certs/
6、所有节点的凭证发送到其他所有节点的certs目录
7、配置config/elasticsearch.yml，打开安全模式，重启集群
8、设置角色、用户等
https://www.elastic.co/guide/en/elasticsearch/reference/7.4/defining-roles.html
https://www.elastic.co/guide/en/elasticsearch/reference/7.4/users-command.html