# Beats - x509: certificate signed by unknown authority

**URL:** https://discuss.elastic.co/t/beats-x509-certificate-signed-by-unknown-authority/153988
**Category:** Beats
**Created:** [October 25, 2018, 11:17am UTC](https://discuss.elastic.co/t/beats-x509-certificate-signed-by-unknown-authority/153988 "2018-10-25T11:17:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Oliver\_Hough](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@Oliver\_Hough](https://discuss.elastic.co/u/Oliver_Hough)
#### Post date: [October 25, 2018, 11:17am UTC](https://discuss.elastic.co/t/beats-x509-certificate-signed-by-unknown-authority/153988/1 "2018-10-25T11:17:18Z")

</div>

I am getting `x509: certificate signed by unknown authority` in Metricbeat logs while trying to ship to Logstash. On the same host though, Filebeat is able to ship logs successfully to the same Logstash server using the same SSL configuration.

My `metricbeat.yml` looks like this

```auto
  logstash:
    enabled: true
    hosts:
      - ${LOGSTASH_HOST}:5044
    timeout: 15
    ssl:
      certificate_authorities:
      - /etc/pki/tls/certs/logstash.crt

```

My `filebeat.yml`

```auto
  logstash:
    enabled: true
    hosts:
      - ${LOGSTASH_HOST}:5044
    timeout: 15
    ssl:
      certificate_authorities:
      - /etc/pki/tls/certs/logstash.crt

```

My `02-beats-input.conf` on Logstash server

```auto
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/logstash/logstash.crt"
    ssl_key => "/etc/logstash/logstash.key"
  }
}

```

Would appreciate if anyone could help with this.

---

<div class="post-metadata">

### Author: ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [October 29, 2018, 6:30pm UTC](https://discuss.elastic.co/t/beats-x509-certificate-signed-by-unknown-authority/153988/2 "2018-10-29T18:30:10Z")

</div>

Oliver, this is indeed strange. Is this the same version of filebeat and metricbeat?

Are there any other errors in the logs?

---

<div class="post-metadata">

### Author: ![Oliver\_Hough](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@Oliver\_Hough](https://discuss.elastic.co/u/Oliver_Hough)
#### Post date: [November 9, 2018, 11:11am UTC](https://discuss.elastic.co/t/beats-x509-certificate-signed-by-unknown-authority/153988/3 "2018-11-09T11:11:32Z")

</div>

Turned out this was just Metricbeat using an out of date certificate, restarting it solved the issue.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2018, 1:11pm UTC](https://discuss.elastic.co/t/beats-x509-certificate-signed-by-unknown-authority/153988/4 "2018-12-07T13:11:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
