# Beats SSL Cert & Key exposure

**URL:** <https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061>\
**Category:** Beats\
**Tags:** elastic-stack-security, auditbeat, metricbeat, filebeat, winlogbeat\
**Created:** [July 6, 2020, 8:55pm UTC](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061 "2020-07-06T20:55:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [July 6, 2020, 8:55pm UTC](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061/1 "2020-07-06T20:55:03Z")

</div>

In every \*beat.yml file we define the output destination, In my case we use logstash for logs to be ingested from beats. Along the beats config.yml file we supply the logstash and kibana ssl cert and it's key.

```auto
output.logstash:
  hosts: ["<logstash-host-address>:5042"]
  bulk_max_size: 1024
  ssl.certificate_authorities: "/etc/filebeat/certs/ca.crt"
  ssl.certificate: "/etc/filebeat/certs/<logstash>.crt"
  ssl.key: "/etc/filebeat/certs/<logstash>.key"
  loadbalance: true

setup.kibana:
  host: "https://<kibana-host-address>:5601"
  username: "elastic"
  password: "${ES_PWD}"
  ssl.certificate_authorities: "/etc/filebeat/certs/ca.crt"
  ssl.certificate: "/etc/filebeat/certs/<kibana>.crt"
  ssl.key: "/etc/filebeat/certs/<kibana>.key"

```

**Question** : How safe is it to place (and/or) why do we need both the cert and key on the beats agent considering the compromise of our corporate cert & key which may lead to impersonation  
[As my base understanding on certificate functioning: we should only supply the CA-Root Cert for trusting host(logstash.kibana) cert]

Can anyone please help me in understanding the usecase of supplying these two entities and also I would request a secure way of using these (cert & key) if it's really needed on beats agents

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 7, 2020, 1:14am UTC](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061/2 "2020-07-07T01:14:41Z")

</div>

The `ssl.certificate` and `ssl.key` are used to specify _client_ certificates for the SSL connection.  
Client certificates (sometimes known as mutual TLS) are used to authenticate the client to the server.

You _should not_ specify the logstash or kibana certificate and key in your `*beat.yml`. In typical configurations you do not need to specify these at all. It is very rare for Kibana to use client certificates. It is a little more common in the case Logstash (because Logstash doesn't offer the same username/password authentication option that Kibana has), but is not the most common setup.

I expect in your case that you can just remove these lines from your config.

If it turns out that you do need client certificates, then you should not use the logstash/kibana ones, and should instead get a new certificate that is specifically for your beats.

If you can point out which documentation lead you to believe that this was the configuration you need, then please let us know and so we can see if there is a way to make it more clear.

---

<div class="post-metadata">

**Author:** ![vishakh](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vishakh](https://discuss.elastic.co/u/vishakh)\
**Post date:** [July 8, 2020, 1:18pm UTC](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061/3 "2020-07-08T13:18:04Z")

</div>

Thank You @TimV for your valuable response.  
On the logstash-pipeline, I've removed the `forced_peer` config and changed to `peer`.  
On beats, I'm just passing the root ca-cert and connection is well established.

The article which I referred before which stated to use cert & key was : [configuring-ssl-logstash](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html#configuring-ssl-logstash)

Question: Now I'm just using root ca.cert on beats. Is it safe to use the same auth-method on production system without leading to any other security compromise ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 5, 2020, 3:18pm UTC](https://discuss.elastic.co/t/beats-ssl-cert-key-exposure/240061/4 "2020-08-05T15:18:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.