# Cannot receive logs from Filebeat in Logstash, SSL Problem

**URL:** <https://discuss.elastic.co/t/cannot-receive-logs-from-filebeat-in-logstash-ssl-problem/241496>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [July 16, 2020, 3:45pm UTC](https://discuss.elastic.co/t/cannot-receive-logs-from-filebeat-in-logstash-ssl-problem/241496 "2020-07-16T15:45:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ngerpiel](https://avatars.discourse-cdn.com/v4/letter/n/ac91a4/32.png) [@ngerpiel](https://discuss.elastic.co/u/ngerpiel)\
**Post date:** [July 16, 2020, 3:45pm UTC](https://discuss.elastic.co/t/cannot-receive-logs-from-filebeat-in-logstash-ssl-problem/241496/1 "2020-07-16T15:45:39Z")

</div>

I have a problem with sending logs from filebeat to logstash node using ssl certificates.  
The error I get is this:

```auto
javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE

```

My logstash input configuration is as follows:

```auto
    input { 
       beats {
         port => 8123
         ssl => true
         ssl_certificate_authorities => ["/path/to/some/ca/cert/CA.crt"]
         ssl_certificate => "/path/to/some/logstash/cert/logstash.crt"
         ssl_key => "/path/to/some/logstash/key/logstash.pkcs8.key"
         ssl_key_passphrase => "${LOGSTASH_KEY_PASS}"
         ssl_verify_mode => "peer"
       }
    }

```

My Filebeat output configuration is as follows:

```auto
    output.logstash:
       hosts: ["logstashloadbalancerdns:8123"]
       ssl.certificate_authorities: ["/path/to/some/ca/cert/CA.crt"]

```

When I try to curl Logstash I get the following:

```auto
    ~]$ curl -v --cacert /path/to/some/ca/cert/CA.crt https://logstash:8123
     About to connect() to logstash.elvicorp.com port 8123 (#0)
     * Trying 172.16.16.16...
     * Connected to logstash.elvicorp.com (172.16.16.16) port 8123 (#0)
     * Initializing NSS with certpath: :/etc/pki/nssdb
     * Closing connection 0
     curl: (77) Problem with the SSL CA cert (path? access rights?)
    ~]$ 

```

Can somebody help me in this issue?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 17, 2020, 11:06am UTC](https://discuss.elastic.co/t/cannot-receive-logs-from-filebeat-in-logstash-ssl-problem/241496/2 "2020-07-17T11:06:13Z")

</div>

> [@ngerpiel](#):
>
> `ssl_verify_mode => "peer"`

This Logstash config specifies that the client (beats) is required to send it's own certificate for client authentication.  
Your beats config doesn't set up a certificate/key, so it fails.

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [July 17, 2020, 12:35pm UTC](https://discuss.elastic.co/t/cannot-receive-logs-from-filebeat-in-logstash-ssl-problem/241496/3 "2020-07-17T12:35:31Z")

</div>

> [@TimV](#):
>
> Your beats config doesn't set up a certificate/key, so it fails.

You need to add both ssl.certificate and ssl.key corresponding to your host.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2020, 12:35pm UTC](https://discuss.elastic.co/t/cannot-receive-logs-from-filebeat-in-logstash-ssl-problem/241496/4 "2020-08-14T12:35:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.