# Filebeat Setup Fails with Wildcard Certificate

**URL:** <https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847>\
**Category:** Beats\
**Created:** [August 5, 2019, 4:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847 "2019-08-05T16:24:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zamiell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zamiell/32/51665_2.png) [@Zamiell](https://discuss.elastic.co/u/Zamiell)\
**Post date:** [August 5, 2019, 4:24pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847/1 "2019-08-05T16:24:55Z")

</div>

Greetings. I found a bug in beats, but I went to open a bug issue on GitHub but the prompts directed me here to confirm that it was a bug first.

Steps to reproduce:

1. Vanilla CentOS 7
2. Download and install filebeat-6.8.0-x86\_64.rpm
3. Edit "/etc/filebeat/filebeat.yml" to include the host, username, and password of the remote ElasticSearch cluster with HTTPS enabled on a wildcard certificate.
4. Run "filebeat -e setup".

This results in the following error:

```auto
2019-08-05T12:16:20.409-0400 ERROR elasticsearch/elasticsearch.go:252 Error connecting to Elasticsearch at https://es-1-dev.company.com:9200: Get https://es-1-dev.company.com:9200: x509: certificate is valid for es-*.company.com, not es-1-dev.company.com

```

Did whoever program this forget about wildcard certificates? Please let me know next steps.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 19, 2019, 6:51pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847/2 "2019-08-19T18:51:09Z")

</div>

Partial wildcards are not supported because Go does not support them.

> <https://github.com/golang/go/issues/24888>

---

<div class="post-metadata">

**Author:** ![Zamiell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zamiell/32/51665_2.png) [@Zamiell](https://discuss.elastic.co/u/Zamiell)\
**Post date:** [August 19, 2019, 7:21pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847/3 "2019-08-19T19:21:30Z")

</div>

Wow, that seems pretty crazy. Thanks for the info Andrew.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [August 19, 2019, 7:41pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847/4 "2019-08-19T19:41:29Z")

</div>

Try a full wildcard cert. That should work fine.

---

<div class="post-metadata">

**Author:** ![Zamiell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zamiell/32/51665_2.png) [@Zamiell](https://discuss.elastic.co/u/Zamiell)\
**Post date:** [August 19, 2019, 7:56pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847/5 "2019-08-19T19:56:35Z")

</div>

Many companies do not allow full wildcard certificates for security purposes - if an attacker gains access to such a certificate, the results would be devastating. The fact that Golang does not support a security feature that is specified by the RFC is disappointing, to say the least.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2019, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-setup-fails-with-wildcard-certificate/193847/6 "2019-09-16T21:56:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.