# Does http\_poller handle https?
**URL:** https://discuss.elastic.co/t/does-http-poller-handle-https/28864
**Category:** Logstash
**Created:** [September 8, 2015, 6:44pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864 "2015-09-08T18:44:47Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 8, 2015, 6:44pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/1 "2015-09-08T18:44:47Z")
This input plugin looks perfect for what I need except I need to call https and so must provide certificate information. I found this closed github issue, [https://github.com/logstash-plugins/logstash-input-http\_poller/issues/2](https://github.com/logstash-plugins/logstash-input-http_poller/issues/2), and I followed the links and read the commits but see nothing about https. I thought about opening another github issue but thought I'd better post here first in case someone has better insight.
Thanks,
Craig
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [September 10, 2015, 9:43am UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/2 "2015-09-10T09:43:24Z")
It does, check the docs - [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http\_poller.html](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http_poller.html)
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 15, 2015, 4:41pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/3 "2015-09-15T16:41:37Z")
Thanks for the link Mark. I'm getting a little further. I'm specifying "truststore", "truststore\_password", "client\_cert" as myCert.cer, and "client\_key" as myKey.key. I'm still getting a "\_http\_request\_failure" though and I'm having trouble determining why.
I'm getting `"error" => "string not matched"` and "backtrace" =\> [
"org/jruby/rubyString.java:3912:in `[]='", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.4-java/lib/logstash/event.rb:73:in`initialize'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-json-1.0.1/lib/logstash/codecs/json.rb:44:in `decode'", file:/opt/logstash/vendor/bundle/jruby/1.9/lib/jruby.jar!/jruby/java.util.rb:7:in`each'",
"/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-json-1.0.1/lib/logstash/codecs/json.rb:44:in `decode'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-http_poller-1.1.2/lib/logstash/inputs/http_poller.rb:156:in 'handle_success'", ... "Manticore$$Response_1817397330.gen:13:in`call'"
]
I'm guessing that being in handle\_success is a good thing but I have no idea what the string comparison is about. Any ideas? It should be returning something like ["a","b","c"]. Am I correct in passing in .cer and .key files? Are there any https examples I can look at?
Thanks,
Craig
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 15, 2015, 5:06pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/4 "2015-09-15T17:06:57Z")
UPDATE: I changed the url I was using to one that returns a json object rather than an array. Now I'm getting a different response: "403 forbidden, unable to authenticate user - no certificate provided". I'm sure my .cer and .key files are there and are valid so I assume I should be passing in something else. A https example would go a long way right now 🙂 Again, any help greatly appreciated.
Craig
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 15, 2015, 5:23pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/5 "2015-09-15T17:23:07Z")
UPDATE: I changed the .cer to a .crt file with the start/end certificate string from my pem file. Same result.
I see in the rest service's code though that it expects a request attribute named "javax.servlet.request.X509certificate" for the cert and it apparently isn't finding it. Does this plugin pass my .crt in as that?
p.s. if I'm creating too much noise or doing anything wrong by posting here, please let me know. I'm in a bit of a vacuum here.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 16, 2015, 1:52pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/6 "2015-09-16T13:52:11Z")
UPDATE: I'm supplying a .crt and a .key file but I see no way to supply the key password...!?
Examples people! We need examples!
---
### Author:  [@andrewvc](https://discuss.elastic.co/u/andrewvc)
#### Post date: [September 16, 2015, 3:49pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/7 "2015-09-16T15:49:48Z")
Craig, you'll need to set the 'cacert' option. truststore is for java .jks keystore files.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 16, 2015, 4:20pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/8 "2015-09-16T16:20:17Z")
Sorry I don't understand. I have the "truststore" set to my truststore.jks and "truststore\_password" set to its password. That's for "who I trust". That much is correct, yes? As for "who I am", I've tried not setting "client\_cert" and "client\_key" and instead setting "cacert" to different formats of my keystore: a .pem, a .cer and a .jks. What should it be set to? Also I see no way to supply the keystore password. Thanks for replying by the way 😄
---
### Author:  [@andrewvc](https://discuss.elastic.co/u/andrewvc)
#### Post date: [September 16, 2015, 4:36pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/9 "2015-09-16T16:36:38Z")
CraigFoote can you open an issue for providing the keystore\_password option? That was an oversight of mine in developing the API. Currently there's no way to provide one.
You can of course use PEM files for now. For "who I am" client\_cert / client\_key should work. That they aren't is a bug unfortunately. Are you sure the client isn't connecting those values?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 16, 2015, 4:55pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/10 "2015-09-16T16:55:22Z")
Just so I create the ticket right, am I correct in understanding the intent of the 'cacert' option as being the certificate keystore, e.g. 'myCert.jks'? And that normally a password is required so we're missing a 'cacert\_password' option?
Sorry I'm being a little dense but I still don't fully understand. Am I correct in setting the 'truststore' and 'truststore\_password' options? And, until the 'cacert\_password' option is available, to what should I set the 'client\_cert' and 'client\_key' to exactly? My understanding of a .pem file is that it contains public certificates and optionally private keys, the latter requiring a password. I think I need to supply my private key and somehow its password but I'm new to this stuff and it seems you know how it can work.
Oh I just remembered, I checked the code of the rest service I'm calling and it expects a request attribute called 'javax.servlet.request.X509Certificate'. Do you know if this is being set?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 18, 2015, 1:20pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/11 "2015-09-18T13:20:36Z")
bumping
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 21, 2015, 12:59pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/12 "2015-09-21T12:59:05Z")
Bumping again. Sorry I really need an answer on this.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 22, 2015, 7:27pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/13 "2015-09-22T19:27:45Z")
Bumping again. Sorry I really need an answer on this.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 23, 2015, 7:10pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/14 "2015-09-23T19:10:27Z")
Bumping again. Sorry I really need an answer on this. Is this pissing anyone off as much as me yet?
---
### Author:  [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 23, 2015, 9:14pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/15 "2015-09-23T21:14:20Z")
Craig, cacert is not for JKS. cacert is for .pem files . If you try again with that option it should work for you.
---
### Author:  [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 23, 2015, 9:15pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/16 "2015-09-23T21:15:17Z")
It looks like you may be able to convert between the formats using the instructions here, though I haven't tried it myself. [http://um.terracotta.org/index.html#page/Universal\_Messaging\_Documentation\_Set/to-jksToPem.html](http://um.terracotta.org/index.html#page/Universal_Messaging_Documentation_Set/to-jksToPem.html)
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 24, 2015, 4:43pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/17 "2015-09-24T16:43:21Z")
Thanks for responding Andrew. I tried setting the 'cacert' option to my non-password-encoded _key.pem_ file that I created using the link you provided. Unfortunately I'm getting:
"PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"
Any ideas?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [September 24, 2015, 5:20pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/18 "2015-09-24T17:20:26Z")
Do I need to use the _truststore_ and _truststore\_password_ options. I did and got a different error: "key usage does not allow key encipherment". I don't know if I'm getting further or if providing the truststore options are causing a different error. As the truststore is "who I trust". it seems to me I shouldn't need to provide it; I should only need to provide "who I am" via the private key, right?
---
### Author:  [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)
#### Post date: [September 24, 2015, 7:29pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/19 "2015-09-24T19:29:44Z")
Apologies Craig, I missed that you were using a clientside KEY.
I think I can clear this all up now.
'cacert' lets you set an alternate CA, performing the same role as a truststore. This lets you accept a custom cert from a remote server.
Specifying a custom clientside certificate for x509 auth requires setting 'client\_key' to the local key for your client as well as setting 'client\_cert' with the signature for that key.
I apologize for the confusion. SSL is generally very confusing.
---
### Author:  [@vikbon](https://discuss.elastic.co/u/vikbon)
#### Post date: [October 3, 2015, 12:42pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864/20 "2015-10-03T12:42:56Z")
Did you ever this issue resolved? I'm getting the same error trying using http\_poller plugin on https server.
my config is below
input {
http\_poller {
urls =\> {
test =\> {
method =\> get
url =\> "[https://labhub01.prolab.inc/lwl/api?json={"inspector"%3A"4"%2C"basis"%3A"machines"%2C"date"%3A"2%20hours"%2C"limit"%3A"0"}](https://labhub01.prolab.inc/lwl/api?json=%7B%22inspector%22%3A%224%22%2C%22basis%22%3A%22machines%22%2C%22date%22%3A%222%20hours%22%2C%22limit%22%3A%220%22%7D)"
verify\_cert =\> false
cacert =\> "c:\temp\cacert.pem"
}
[Next page](https://discuss.elastic.co/t/does-http-poller-handle-https/28864.md?page=2)