# Filebeat not connecting to elasticsearch over ssl

**URL:** <https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940>\
**Category:** Beats\
**Tags:** elastic-stack-security, filebeat\
**Created:** [August 11, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940 "2022-08-11T15:05:16Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)\
**Post date:** [August 11, 2022, 3:05pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/1 "2022-08-11T15:05:16Z")

</div>

I installed elasticsearch 8.3.3 on ubuntu 18.04 and allowed xpack.

```auto
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200 

```

after entering the password gives the result

```auto
{
  "name" : "mgmt-els-01",
  "cluster_name" : "mgmt-els-01",
  "cluster_uuid" : "m5yvSutmRvqutn6DmCLlZQ",
  "version" : {
    "number" : "8.3.3",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "801fed82df74dbe537f89b71b098ccaff88d2c56",
    "build_date" : "2022-07-23T19:30:09.227964828Z",
    "build_snapshot" : false,
    "lucene_version" : "9.2.0",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

```

Generated fingerprint

```auto
openssl x509 -fingerprint -sha256 -in /etc/elasticsearch/certs/http_ca.crt

```

and pasted it into the filebeat config on another server.

But when I try to send logs to the elasticsearch server, I get an error -

```auto
[2022-08-11T13:40:43,636][WARN][o.e.h.AbstractHttpServerTransport] [mgmt-els-01] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/172.61.10.49:9200, remoteAddress=/10.67.8.72:42476}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

```

Filebeat config:

```auto
# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  hosts: ["mgmt-els-01.node.consul"]
  protocol: https
  username: "filebeat"
  password: "somepasswd"

  ssl:
    enabled: true
    ca_trusted_fingerprint: "fingerprint" 

```

filebeat version

```auto
filebeat version 8.3.3 (amd64), libbeat 8.3.3 [1755b5dd3127bf755ee39deb25a802438bdac620 built 2022-07-23 00:34:44 +0000 UTC]

```

What am I doing wrong?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 11, 2022, 5:08pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/2 "2022-08-11T17:08:18Z")

</div>

Hi @pauldon2 When you setup elasticsearch you should have been provided the fingerprint... do you have that? Did you try that?

Example

```auto
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ Elasticsearch security features have been automatically configured!
✅ Authentication is enabled and cluster connections are encrypted.

ℹ️ Password for the elastic user (reset with `bin/elasticsearch-reset-password -u elastic`):
	askdjfhasldkfjhasdflkjashdf

ℹ️ HTTP CA certificate SHA-256 fingerprint:
  2d15f23e450524d8619872025345beeebcabba656a29c068c9187478371274f0

```

When I ran the command you provided it the finger print is produced is

```auto
2D:15:F2:3E:45:05:24:D8:61:98:72:02:53:45:BE:EE:BC:AB:BA:65:6A:29:C0:68:C9:18:74:78:37:12:74:F0

```

Which is the same but with the `:` perhaps you need to remove those.

perhaps

openssl x509 -fingerprint -sha256 -in ./http\_ca.crt | sed -e 's/://g'  
my result

````auto
SHA256 Fingerprint=2D15F23E450524D8619872025345BEEEBCABBA656A29C068C9187478371274F0
```
````

---

<div class="post-metadata">

**Author:** ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)\
**Post date:** [August 12, 2022, 6:31am UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/3 "2022-08-12T06:31:40Z")

</div>

I installed elasicsearch on Ubuntu 18.04 using the package manager and didn't get a fingerprint.  
But after that (as I wrote) I got it using the command

```auto
openssl x509 -fingerprint -sha256 -in /etc/elasticsearch/certs/http_ca.crt

```

I just tried removing the ":" and saved the resulting fingerprint to the filebeat config.  
But I still get the same error.

```auto
[2022-08-12T06:21:52,524][WARN][o.e.h.AbstractHttpServerTransport] [mgmt-els-01] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/172.61.10.49:9200, remoteAddress=/10.67.8.72:34676}
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 12, 2022, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/4 "2022-08-12T13:52:32Z")

</div>

@pauldon2  
I think the fingerprint is fine and just FYI the data I showed above does come up when installing a .deb / .rpm it may have just scrolled by but I think you are good.

We all love cert issues right? 🙂

I don't think this is a fingerprint issues... you could validate that by trying to run filebeat on the elasticsearch host and use `localhost` as the elasticsearch address.

How did you configure / create the cert? ... in short I suspect that the "name" you are trying to access elasticsearch by `mgmt-els-01.node.consul` is not part of the Common Name / Domain in the cert... the default will only have the hostname, and IP address.... unless you specifically set that up.

Can you try the IP address instead of the FQDN or perhaps just `mgmt-els-01`

---

<div class="post-metadata">

**Author:** ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)\
**Post date:** [August 12, 2022, 2:29pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/5 "2022-08-12T14:29:00Z")

</div>

> Blockquote  
> How did you configure / create the cert? ... in short I suspect that the "name" you are trying to access elasticsearch by `mgmt-els-01.node.consul` is not part of the Common Name / Domain in the cert... the default will only have the hostname, and IP address.... unless you specifically set that up.  
> Can you try the IP address instead of the FQDN or perhaps just `mgmt-els-01`

Yes! 🙂 I changed FQDN to IP and everything worked. Thanks a lot!

P.S. Where can I read how to add FQDN to a previously generated certificate?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 12, 2022, 4:03pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/6 "2022-08-12T16:03:47Z")

</div>

> [@pauldon2](#):
>
> P.S. Where can I read how to add FQDN to a previously generated certificate?

So I am good with certificates but I am not the expert ninja.

But what I will say is you're not going to be able to add it to the existing one for a several reasons, but the most important is it has a password applied to it that has been added to the key store which you'll never be able to see again. So you're going to need to create a new cert for the HTTPS endpoint. That's my understanding.

You will want to use cert mode with this command

> **[elasticsearch-certutil | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html)**

Also, I wrote a how to for the 7.x version. I think it's still applies. You can take a look at that

[https://github.com/bvader/howtos/blob/master/basic-security-elasticsearch/README.md](https://github.com/bvader/howtos/blob/master/basic-security-elasticsearch/README.md)

---

<div class="post-metadata">

**Author:** ![pauldon2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pauldon2/32/32079_2.png) [@pauldon2](https://discuss.elastic.co/u/pauldon2)\
**Post date:** [August 12, 2022, 7:22pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/7 "2022-08-12T19:22:17Z")

</div>

Wonderful. Especially the second document. Tomorrow I will try to follow it step by step. Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2022, 9:22pm UTC](https://discuss.elastic.co/t/filebeat-not-connecting-to-elasticsearch-over-ssl/311940/8 "2022-09-09T21:22:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.