# Guide for Generating valid Certs for Logstash / Filebeat SSL Setup
**URL:** https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965
**Category:** Logstash
**Created:** [April 20, 2017, 1:10am UTC](https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965 "2017-04-20T01:10:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@ninjada](https://discuss.elastic.co/u/ninjada)
#### Post date: [April 20, 2017, 1:10am UTC](https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965/1 "2017-04-20T01:10:30Z")
hi guys,
this stumps me every time i setup an ELK stack for some reason.. I had it sussed out last time i was deploying multiple ELK stacks on version 2.x
have just finished testing 5.x and am readying to get everything production ready eg. SSL and security configuration but am hitting the same problem.
im receiving the error: cannot validate certificate for 10.10.1.169 because it doesn't contain any IP SANs..
is there a definitive guide to generating SSL? cause ive tried 2 now and i receive errors.
ideally i'd like one to cover just a host name, eg. elk.myinstance.aws -- as the server may change public & private IP...
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 24, 2017, 5:19am UTC](https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965/2 "2017-04-24T05:19:39Z")
How are you creating the certificate? What do the Filebeat and Logstash configurations look like?
---
### Author:  [@ninjada](https://discuss.elastic.co/u/ninjada)
#### Post date: [May 1, 2017, 3:01am UTC](https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965/3 "2017-05-01T03:01:55Z")
to be honest I've lost count now, i've tried a bunch..
heres what i last used.. generating the certs using:
for logstash server:
sudo openssl req -subj '/CN=elk.mydomain/‘ -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout /etc/pki/logstash/private/logstash.key -out /etc/pki/logstash/certs/logstash.crt
for filebeat servers:
sudo openssl req -subj '/CN=elk.mydomain/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout /etc/pki/logstash/private/filebeat.key -out /etc/pki/logstash/certs/filebeat.crt
where elk.mydomain is the internal dns route i setup on EC@ and what i point all servers running filebeat to goto.
preferrably i'd like it to just work based on that DNS entry, but i either get IP SAN errors or invalid key format errors...
is there a definitive guide for this?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 3, 2017, 5:13am UTC](https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965/4 "2017-05-03T05:13:03Z")
Please answer both of my questions.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2017, 5:18am UTC](https://discuss.elastic.co/t/guide-for-generating-valid-certs-for-logstash-filebeat-ssl-setup/82965/5 "2017-05-31T05:18:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.