# Beats Certificate verification with ElasticSearch/Kibana

**URL:** <https://discuss.elastic.co/t/beats-certificate-verification-with-elasticsearch-kibana/264689>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/beats-certificate-verification-with-elasticsearch-kibana/264689 "2021-02-18T10:39:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![radu990](https://avatars.discourse-cdn.com/v4/letter/r/c57346/32.png) [@radu990](https://discuss.elastic.co/u/radu990)\
**Post date:** [February 18, 2021, 10:39am UTC](https://discuss.elastic.co/t/beats-certificate-verification-with-elasticsearch-kibana/264689/1 "2021-02-18T10:39:16Z")

</div>

Hello,

I have configured SSL on both Elasticsearch and Kibana, and I can connect ok to it via browser. However when trying to configure Beats (Winlogbeat, Filebeat) to work with certificates, I see the following under test output - **security... WARN server's certificate chain verification is disabled**

```
    PS C:\Program Files\Winlogbeat> .\winlogbeat.exe test output
elasticsearch: https://192.168.1.70:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.1.70
    dial up... OK
  TLS...
    security... WARN server's certificate chain verification is disabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 7.11.0

```

My elasticsearch.yml config file entries (related to SSL):

> ```
> xpack.security.enabled: true
> xpack.security.http.ssl.enabled: true
> xpack.security.http.ssl.keystore.path: "http.p12"
> 
> ```

My kibana.yml SSL config file entries (related to SSL):

> ```
> elasticsearch.username: "kibana_system"
> elasticsearch.password: "password"
> elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/elasticsearch-ca.pem"]
> #elasticsearch.ssl.verificationMode: none
> elasticsearch.ssl.verificationMode: certificate
> 
> # Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
> # These settings enable SSL for outgoing requests from the Kibana server to the browser.
> server.ssl.enabled: true
> server.ssl.certificate: /ca/ca.crt
> server.ssl.key: /ca/ca.key
> 
> ```

My winlogbeat.yml config file:

> ```
> setup.kibana:
> 
> # Kibana Host
> # Scheme and port can be left out and will be set to the default (http and 5601)
> # In case you specify and additional path, the scheme is required: http://localhost:5601/path
> # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
> host: "https://192.168.1.70:5601"
> ssl.enabled: true
> #ssl.verification_mode: none
> ssl.verification_mode: certificate
> ssl.certificate_authorities: C:\Program Files\Winlogbeat\kibana.pem
> ssl.certificate: C:\Program Files\Winlogbeat\ca\ca.crt
> ssl.key: C:\Program Files\Winlogbeat\ca\ca.key
>   
> # Kibana Space ID
> # ID of the Kibana Space into which the dashboards should be loaded. By default,
> # the Default Space will be used.
> #space.id:
> 
> # =============================== Elastic Cloud ================================
> 
> # These settings simplify using Winlogbeat with the Elastic Cloud (https://cloud.elastic.co/).
> 
> # The cloud.id setting overwrites the `output.elasticsearch.hosts` and
> # `setup.kibana.host` options.
> # You can find the `cloud.id` in the Elastic Cloud web UI.
> #cloud.id:
> 
> # The cloud.auth setting overwrites the `output.elasticsearch.username` and
> # `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
> #cloud.auth:
> 
> # ================================== Outputs ===================================
> 
> # Configure what output to use when sending the data collected by the beat.
> 
> # ---------------------------- Elasticsearch Output ----------------------------
> output.elasticsearch:
> # Array of hosts to connect to.
> hosts: ["192.168.1.70:9200"]
> 
> # Protocol - either `http` (default) or `https`.
> protocol: "https"
> #ssl.enabled: true
> #ssl.verification_mode: none
> ssl.verification_mode: certificate
> ssl.certificate_authorities: C:\Program Files\Winlogbeat\http2.pem
> #ssl.certificate: http2.pem
> #ssl.key: http.key
>   
> # Authentication credentials - either API key or username/password.
> #api_key: "id:api_key"
> username: "elastic"
> password: "password"
> 
> ```

**Should I add xpack.security.transport.ssl.enabled entries in elasticsearch.yml? Or what do I need to change/add to enable certificate verification for Beats in Elasticsearch/Kibana?**  
I would like to have the traffic encrypted between the beats and elasticsearch/kibana server.  
Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 18, 2021, 12:39pm UTC](https://discuss.elastic.co/t/beats-certificate-verification-with-elasticsearch-kibana/264689/2 "2021-03-18T12:39:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.