# Forcing Logstash to use TLS 1\_2

**URL:** <https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869>\
**Category:** Logstash\
**Created:** [August 20, 2019, 9:09am UTC](https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869 "2019-08-20T09:09:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zerobot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerobot/32/48977_2.png) [@Zerobot](https://discuss.elastic.co/u/Zerobot)\
**Post date:** [August 20, 2019, 9:09am UTC](https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869/1 "2019-08-20T09:09:51Z")

</div>

Hi!

Is it possible to force Logstash (TCP\_INPUT) into using TLS v.1.2 only?  
Beats Input is actually using 1\_2 but sadly my TCP input is using 1.0, 1.1 and 1.2.  
Also, while starting Logstash I see:

> ```
> ssl.enabled.protocols = [TLSv1.2, TLSv1.1, TLSv1]
> 
> ```

Is there any way to force Logstash into using TLSv1.2 and only this one?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 20, 2019, 11:44am UTC](https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869/2 "2019-08-20T11:44:41Z")

</div>

Which JRE are you using (vendor and version)?

---

<div class="post-metadata">

**Author:** ![Zerobot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerobot/32/48977_2.png) [@Zerobot](https://discuss.elastic.co/u/Zerobot)\
**Post date:** [August 20, 2019, 12:13pm UTC](https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869/3 "2019-08-20T12:13:48Z")

</div>

> openjdk version "1.8.0\_222"  
> OpenJDK Runtime Environment (build 1.8.0\_222-b10)  
> OpenJDK 64-Bit Server VM (build 25.222-b10, mixed mode)

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 20, 2019, 12:23pm UTC](https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869/4 "2019-08-20T12:23:02Z")

</div>

There is a [request](https://github.com/logstash-plugins/logstash-input-tcp/issues/127) to enable this within logstash. Otherwise you need to do it in the JRE. Does [this](https://stackoverflow.com/questions/32466407/how-to-force-java-server-to-accept-only-tls-1-2-and-reject-tls-1-0-and-tls-1-1-c) help? To be honest I doubt it will ever get added to logstash because anyone who cares about disabling 1.1 will be comfortable doing it globally in the JRE.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2019, 12:28pm UTC](https://discuss.elastic.co/t/forcing-logstash-to-use-tls-1-2/195869/5 "2019-09-17T12:28:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.