# Filebeat and Logstash certificate and key
**URL:** https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990
**Category:** Beats
**Tags:** filebeat
**Created:** [June 27, 2016, 2:29am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990 "2016-06-27T02:29:47Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@fjiang212](https://discuss.elastic.co/u/fjiang212)
#### Post date: [June 27, 2016, 2:29am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990/1 "2016-06-27T02:29:47Z")
I follow the doc ([https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-14-04)) to generate certificate and private key, then use them in both filebeat and logstash to make the TSL connection work. But I am still confuse here:
- Why the filebeat and logstash use the same certificate here, Originally I thought client and server have different certificate: client.crt and server.crt
- Why we copy server private key file to filebeat. I always think we should keep private key on the server side only.
- Does it mean in this case we only verify logstash not filebeat
Could someone knowing TLS shed some light on it? Or explain how TLS work here.
Thanks
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [June 27, 2016, 10:09am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990/2 "2016-06-27T10:09:00Z")
I didn't read through this tutorial, but:
1. do not copy the private file. It's called private for a reason
2. When you're using self-signed certificates (no CA), the client needs to have certificate in its CA list. Using certificate-authorities, the client only requires the CAs certificate to verify the server certificate (this is how it should be done when managing multiple servers). For testing and simple setups self-signed certificates are a little more convenient
3. I didn't see any client certificate configured for client-authentication. This means, filebeat will check logstash being ok, but not the other way around.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 18, 2016, 2:29am UTC](https://discuss.elastic.co/t/filebeat-and-logstash-certificate-and-key/53990/3 "2016-07-18T02:29:47Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.