# Filebeat ssl connection fail with CERT using Subject Alternative Name **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [April 18, 2016, 7:44am UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616 "2016-04-18T07:44:46Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jakub\_Juraszek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakub_juraszek/32/47927_2.png) [@Jakub\_Juraszek](https://discuss.elastic.co/u/Jakub_Juraszek)\ **Post date:** [April 18, 2016, 7:44am UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616/1 "2016-04-18T07:44:46Z")
Hello. I am using filebeat version 1.2.1 (amd64). I've setup logstash with input beats and ssl (ssl\_verify\_mode =\> force\_peer) and self signed certificate containing additional Subject Alternative Name. I am able to connect wi I can connect fine from host using from host connecting via `#filebeat.yml part output: logstash: hosts: [":5000"] tls: insecure: false` but connections via `#filebeat.yml part output: logstash: hosts: [":5000"] tls: insecure: false` fail with: `2016/04/18 07:19:31.624512 transport.go:125: ERR SSL client failed to connect with: x509: certificate is valid for , not ` Is this a bug or it's just not implemented and I missed some FAQ/doc? ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 18, 2016, 11:45am UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616/2 "2016-04-18T11:45:33Z")
certificates are signed for domain names. When setting `insecure: false` (default), certificates will be validated + domain name is compared with certificate. Setting `insecure: true` should disable the domain name check (not recommended due to potential man-in-the-middle attacks). ---
**Author:** ![Jakub\_Juraszek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakub_juraszek/32/47927_2.png) [@Jakub\_Juraszek](https://discuss.elastic.co/u/Jakub_Juraszek)\ **Post date:** [April 18, 2016, 2:53pm UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616/3 "2016-04-18T14:53:43Z")
I've implicitly turn on tls in config (certificate\_authorities, certificate, certificate\_keyca) and set "insecure: false" as I want only to preceed with connection when both server and client are validated via x509. What I am saying is that filebeats (client) is denying to connect to server presenting valid certifitacte (it only validates against SubjectAltName skipping CN) I checked connectivity with openssl s\_client and cert IS valid for both for both STRINGS (one in CN other via SubjectAltName type DNS) I think it is bug in filebeats. I was able to overcome this by adding sime value as CN to additional SubjectAltName So my cert has now CN = X SubjectAltName = X SubjectAltName = Y and only now I can connect via both X,Y ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 18, 2016, 3:30pm UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616/4 "2016-04-18T15:30:05Z")
Just because it works with OpenSSL I wouldn't treat this as a bug in go libs. This stackoverflow post is very helpful on this matter (RFCs are quite hard to read): [http://stackoverflow.com/questions/5935369/ssl-how-do-common-names-cn-and-subject-alternative-names-san-work-together](http://stackoverflow.com/questions/5935369/ssl-how-do-common-names-cn-and-subject-alternative-names-san-work-together) ---
**Author:** ![Jakub\_Juraszek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakub_juraszek/32/47927_2.png) [@Jakub\_Juraszek](https://discuss.elastic.co/u/Jakub_Juraszek)\ **Post date:** [April 18, 2016, 9:23pm UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616/5 "2016-04-18T21:23:39Z")
OMG. I bought/used quite a few "SSL" certs and was quite sure I know what I am speaking about but you just wrecked me 🙂 No more questions / thank you for fast answer and pointing me to more info. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/filebeat-ssl-connection-fail-with-cert-using-subject-alternative-name/47616/6 "2017-07-05T21:53:04Z")