# Error with multiple values in ssl\_certificate\_authorities for elasticsearch output

**URL:** <https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708>\
**Category:** Logstash\
**Created:** [August 28, 2024, 3:40pm UTC](https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708 "2024-08-28T15:40:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pk92](https://avatars.discourse-cdn.com/v4/letter/p/f1d935/32.png) [@pk92](https://discuss.elastic.co/u/pk92)\
**Post date:** [August 28, 2024, 3:40pm UTC](https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708/1 "2024-08-28T15:40:29Z")

</div>

Hi,

when I put a list with multiple elements in "ssl\_certificate\_authorities" for the Elasticsearch output of the Logstash pipeline, like this:

```auto
output {
    elasticsearch {
        hosts => ["https://host1:9200", "https://host2:9200", "https://host3:9200"]
        data_stream => "true"
        user => "logstash_internal"
        password => "pa$$w0rd"
        ssl_enabled => "true"
        ssl_verification_mode => "full"
        ssl_certificate_authorities => ["/path/to/ca.pem","/path/to/another-ca.pem"]
    }
}

```

I get the following error in the Logstash logs, stating that multiple values are not allowed

```auto
[2024-08-28T16:49:13,283][ERROR][logstash.javapipeline][lan] Pipeline error {:pipeline_id=>"lan", :exception=>#<LogStash::ConfigurationError: Multiple values on "ssl_certificate_authorities" are not supported by this plugin>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-11.22.6-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:128:in `setup_ssl'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-11.22.6-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:59:in `build'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-11.22.6-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:42:in `build_client'", "/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/logstash-output-elasticsearch-11.22.6-java/lib/logstash/outputs/elasticsearch.rb:301:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:69:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:237:in `block in register_plugins'", "org/jruby/RubyArray.java:1989:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:236:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:610:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:249:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:194:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:146:in `block in start'"], "pipeline.sources"=>["central pipeline management"], :thread=>"#<Thread:0x6fa0463f /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:134 run>"}

```

Althpugh the documentation for the Elasticsearch output clearly states that the value for ssl\_certificate\_authorities can be a list.

> `ssl_certificate_authorities`
> 
> - Value type is a list of path
> - There is no default value for this setting
> 
> The .cer or .pem files to validate the server’s certificate.

> **[Elasticsearch output plugin | Logstash Reference \[8.15\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ssl_certificate_authorities)**

I would expect that this should be working and it would just use every CA from the given list for validation of certificates. Do I make anything wrong?

Logstash version 8.13.4  
logstash-output-elasticsearch version 11.22.6

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 28, 2024, 4:33pm UTC](https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708/2 "2024-08-28T16:33:41Z")

</div>

That looks like a bug to me. I poked around in the github history a bit and the output used to take a cacert option, which wanted a single certificate. During the standardization of SSL parameters across plugins that was changed to ssl\_certificate\_authorities, which takes a list of certificate files. However, the http\_client mixin library that the output calls still expects a single cert.

---

<div class="post-metadata">

**Author:** ![pk92](https://avatars.discourse-cdn.com/v4/letter/p/f1d935/32.png) [@pk92](https://discuss.elastic.co/u/pk92)\
**Post date:** [August 29, 2024, 7:23am UTC](https://discuss.elastic.co/t/error-with-multiple-values-in-ssl-certificate-authorities-for-elasticsearch-output/365708/3 "2024-08-29T07:23:16Z")

</div>

Thank you for confirming that it is a bug!

I'll have to open an issue in the Github repo then, I guess