# FileBeats -\> MSK : SSL handshake failed when TLS is enabled **URL:** \ **Category:** Beats\ **Tags:** elastic-stack-security, filebeat\ **Created:** [February 16, 2021, 11:59am UTC](https://discuss.elastic.co/t/filebeats-msk-ssl-handshake-failed-when-tls-is-enabled/264424 "2021-02-16T11:59:59Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Ravi342883](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravi342883/32/74643_2.png) [@Ravi342883](https://discuss.elastic.co/u/Ravi342883)\ **Post date:** [February 16, 2021, 12:00pm UTC](https://discuss.elastic.co/t/filebeats-msk-ssl-handshake-failed-when-tls-is-enabled/264424/1 "2021-02-16T12:00:00Z")
Hi All.. I have created a MSK cluster with 3 brokers and enabled encryption at rest and in transit but disabled TLS authentication. I'm trying to send data from Filebeat (7.10.0) --\> AWS MSK over TLS endpoint (9094). Filebeat in installed in one of the AWS EC2 instance within same VPC of AWS MSK cluster. Also included the below value in filebeat.yml o/p section: tls.certificate\_authorities: ["/tmp/kafka.client.truststore.jks"] We have generated the kafka.client.truststore.jks by coping from Java . Refer: [+] Step 6: Produce and Consume Data - [Step 6: Produce and Consume Data - Amazon Managed Streaming for Apache Kafka](https://docs.aws.amazon.com/msk/latest/developerguide/produce-consume.html) From Filebeat Log I'm getting the below msg: 2021-02-12T14:22:33.888Z DEBUG [https://forums.aws.amazon.com/](https://forums.aws.amazon.com/) kafka/client.go:291 Kafka publish failed with: circuit breaker is open I also enabled cloud watch logs for the broker and on the broker side I see the following error message "SocketServer brokerId=1 Failed authentication with /INTERNAL\_IP (SSL handshake failed) (org.apache.kafka.common.network.Selector)" Could you please help out here, many thanks? Thanks, Ravi [Ravindharan@gmail.com](mailto:Ravindharan@gmail.com) ---
**Author:** ![Mario\_Castro](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mario_castro/32/35107_2.png) [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)\ **Post date:** [February 16, 2021, 12:05pm UTC](https://discuss.elastic.co/t/filebeats-msk-ssl-handshake-failed-when-tls-is-enabled/264424/2 "2021-02-16T12:05:02Z")
Duplicate [FileBeats -\> MSK : SSL handshake failed when TLS is enabled](https://discuss.elastic.co/t/filebeats-msk-ssl-handshake-failed-when-tls-is-enabled/264424) ---
**Author:** ![Ravi342883](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ravi342883/32/74643_2.png) [@Ravi342883](https://discuss.elastic.co/u/Ravi342883)\ **Post date:** [February 17, 2021, 11:16am UTC](https://discuss.elastic.co/t/filebeats-msk-ssl-handshake-failed-when-tls-is-enabled/264424/4 "2021-02-17T11:16:49Z")
Hi All, We have fixed this issue 🙂 - adding here for the benefits of others (if). We resolved the SSL handshake issue in MSK end by adding the following entries in filebeat config file. ssl.enabled: true tls: certificate\_authorities - "/home/ec2-user/kafka.client.truststore.jks" Alternatively, we can convert the .jks into .pem and provide the below params in filebeat config file: ssl.certificate\_authorities: ["/home/ec2-user/certificatefile.pem"] By doing anyone of the above we are able to successfully write and read TLS encrypted data from AWS MSK. Thanks, Ravi [Ravindharan@gmail.com](mailto:Ravindharan@gmail.com) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 17, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeats-msk-ssl-handshake-failed-when-tls-is-enabled/264424/5 "2021-03-17T13:17:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.