# Can't figure out how to use certificates correctly **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 31, 2016, 1:53pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949 "2016-03-31T13:53:55Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [March 31, 2016, 1:53pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/1 "2016-03-31T13:53:55Z")
Hello everyone, I need help with configuring filebeat on windows with tls. I created .crt file in my ELK server, and copied it to my windows client. Now I'm trying to configure the filebeat.yml file, I've tried this few configs: ```auto output: logstash: hosts: [logstash ip address] tls: certificate_authorities: - C:\Program Files\Filebeat\filebeat.crt ``` ```auto output: logstash: hosts: [logstash ip address] tls: certificate_authorities: - "C:\Program Files\Filebeat\filebeat.crt" ``` ```auto output: logstash: hosts: [logstash ip address] tls: certificate_authorities: [C:\Program Files\Filebeat\filebeat.crt] ``` In all of those configs, when I ran `-configtest`, I had errors. What's the right way to write these configurations? thank you! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 31, 2016, 5:30pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/2 "2016-03-31T17:30:02Z")
Those configs appear OK to me. What is the error that `-configtest` returns? Check out these TLS troubleshooting resources: - [Why does my SSL client fail to connect to Logstash?](https://www.elastic.co/guide/en/beats/filebeat/current/ssl-client-fails.html) - [Using TLS between Beats and Logstash ](https://gist.github.com/andrewkroh/fdc7e5f3f0f0ed63a11c) ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [March 31, 2016, 9:27pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/3 "2016-03-31T21:27:44Z")
not a windows user myself (just a hunch), but I wonder how these file paths are handled in when parsing the config file. YAML has different types of strings and by default `\` is an escape character, if I'm not mistaken. Using single quotes might help: ```auto output: logstash: hosts: [logstash ip address] tls: certificate_authorities: - 'C:\Program Files\Filebeat\filebeat.crt' ``` or use `\\` whenever you need a backslash ---
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [April 4, 2016, 1:38pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/4 "2016-04-04T13:38:27Z")
Hi, thank you for your response. I followed the tests in both the links you sent and everything was correct. So I decided to go a step back and test if I can output directly to elasticsearch, without TLS. I got the following error in the logs: "Ping request failed... no connection could be made because the target machine actively refused it." Do you know why this happens? Thanks. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 4, 2016, 1:54pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/5 "2016-04-04T13:54:58Z")
> [@muhamadli302](#): > > the target machine actively refused it This is most often caused by a firewall or anti-virus. It could be on same machine running Filebeat, the network in between, or on the ES server. You can test the HTTP HEAD request that Filebeat uses independent of Filebeat by running the command given [here](https://discuss.elastic.co/t/winlogbeat-transport-problem-on-port-80-through-reverse-proxy-to-elasticsearch/40965/6). ---
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [April 4, 2016, 2:07pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/6 "2016-04-04T14:07:49Z")
Thanks, I checked for firewalls on both the ES machine and the Filebeat machine, both don't have any firewalls. I ran the command and my output was an error: "Unable to connect to the remote server" ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 4, 2016, 4:05pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/7 "2016-04-04T16:05:50Z")
is elasticsearch running? ---
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [April 6, 2016, 6:16am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/8 "2016-04-06T06:16:28Z")
yes, it's running ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 6, 2016, 10:52am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/9 "2016-04-06T10:52:59Z")
you have correct port configured? Try to `ping` and `telnet` elasticsearch server. ---
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [April 6, 2016, 10:58am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/10 "2016-04-06T10:58:11Z")
I have ping to the elasticsearch server, and i also can connect to it via putty on port 22, but for some reason i can't telnet to it in port 22 or 9200. any other suggestions? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 6, 2016, 11:03am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/11 "2016-04-06T11:03:18Z")
if telnet to port 9200 (`$ telnet 9200`) not working the port doesn't seem to be available from remote. Check with netstat or ss if some process is listening on port 9200 or some firewall (or any other device in between) is blocking the port with whatever rules. ---
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [April 6, 2016, 11:14am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/12 "2016-04-06T11:14:36Z")
the elastic server is listening on port 9200. I have no firewall running. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 6, 2016, 11:30am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/13 "2016-04-06T11:30:30Z")
as I don't have physical access to your environment I have a hard time to tell what's going on. You have to figure out why telnet is working for you in the first place. If you can get telnet to function beats should work just fine. Did you try `$ curl http://:9200` ? ---
**Author:** ![muhamadli302](https://avatars.discourse-cdn.com/v4/letter/m/b4bc9f/32.png) [@muhamadli302](https://discuss.elastic.co/u/muhamadli302)\ **Post date:** [April 6, 2016, 11:47am UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/14 "2016-04-06T11:47:35Z")
I tried the following command: `$ curl http://192.168.0.110:9200` from my elastic server, and it didn't work, but when I did `$ curl http://localhost:9200` it did work! I checked with `ipconfig` to see I didn't make a mistake with the ip address, and it was OK... From some reason the server can't resolve it's own ip? EDIT: I changed the elasticsearch.yml file, configured it to the ip address instead of just 'localhost'. now the curl command works. I'll try to check the rest of the things that didn't work now. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 6, 2016, 1:04pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/15 "2016-04-06T13:04:38Z")
makes me wonder if server binds to some device/ip only based on config. Never have seen this before. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/cant-figure-out-how-to-use-certificates-correctly/45949/16 "2017-07-05T21:53:45Z")