# Heartbeat returns wrong x.509 information (tls.server.x509) **URL:** \ **Category:** Beats\ **Tags:** heartbeat\ **Created:** [October 8, 2020, 4:28pm UTC](https://discuss.elastic.co/t/heartbeat-returns-wrong-x-509-information-tls-server-x509/251484 "2020-10-08T16:28:34Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![fik](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@fik](https://discuss.elastic.co/u/fik)\ **Post date:** [October 8, 2020, 4:28pm UTC](https://discuss.elastic.co/t/heartbeat-returns-wrong-x-509-information-tls-server-x509/251484/1 "2020-10-08T16:28:34Z")
We have bunch of apps monitored via HTTP endpoints. However, for one of them, heartbeat writes wrong to data to elasticsearch. Data in tls.server.x509 contains old outdated certificate, however it was changed many months ago. Tried to fetch certificate using curl from heartbeat host, it returns proper latest valid certificate info. Where the problem can be? Is there some internal cache in heartbeat or else? ---
**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\ **Post date:** [October 12, 2020, 7:54am UTC](https://discuss.elastic.co/t/heartbeat-returns-wrong-x-509-information-tls-server-x509/251484/2 "2020-10-12T07:54:34Z")
Did you try to restart the heartbeat or run it locally? It looks like a potential issue with heartbeat. ---
**Author:** ![fik](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@fik](https://discuss.elastic.co/u/fik)\ **Post date:** [October 12, 2020, 10:14am UTC](https://discuss.elastic.co/t/heartbeat-returns-wrong-x-509-information-tls-server-x509/251484/3 "2020-10-12T10:14:17Z")
Hi! Yes, I tried to restart it, makes no difference. I will try to run on my local machine, but I assume everything will work fine. And this might be related to heartbeat upgrade from 7.4.0 to 7.9.2. Before the upgrade we received correct data, but after it we started to see outdated info. Also, field was at _tls.certificate\_not\_valid\_after_ in 7.4.0 and now in 7.9.2 we have it in two fields (probably for back-compatibility) in _tls.certificate\_not\_valid\_after_ and _tls.server.x509.not\_after_. Does it makes sense to try to delete and reinstall it? I see that data folder is at _/var/lib/heartbeat_, but there is just empty _heartbeat.lock_ and _meta.json_ with one UUID, so I'm not sure where else it could save/cache some data. ---
**Author:** ![fik](https://avatars.discourse-cdn.com/v4/letter/f/bbe5ce/32.png) [@fik](https://discuss.elastic.co/u/fik)\ **Post date:** [October 13, 2020, 9:25am UTC](https://discuss.elastic.co/t/heartbeat-returns-wrong-x-509-information-tls-server-x509/251484/4 "2020-10-13T09:25:52Z")
Ok, I tried to run both versions on local PC with clean data folders. And weirdly enough, 7.4.0 returns proper data, and 7.9.2 returns expired certificate. And looks like I found the reason, looks like 7.4.0 checks only lowest level certificate expiration date, and 7.9.2 checks entire chain. Expiration date does not match the old certificate, it matches the expiration date of root certificate which should be updated everywhere already. I checked site using [https://www.sslshopper.com/ssl-checker.html](https://www.sslshopper.com/ssl-checker.html) and it shows "USERTrust RSA Certification Authority" as expired. ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/7170fd5a79c6061116bdb001e837fbe29894cfb9.png) Interesting that it shows as valid on IIS. ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/0/1037f7c574a36ea6a51de3373985ab34a567f06d.png) It looks like the problem is in "USERTrust RSA Certification Authority" issued by "AddTrust External CA Root" which expired on 30.05.2020 and root certificate is not properly updated everywhere. [https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020](https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020) > **[Fixing the Breakage from the AddTrust External CA Root Expiration](https://www.agwa.name/blog/post/fixing_the_addtrust_root_expiration)** It shows as valid in browsers and in windows certificate manager, but shows up as expired when using heartbeat or openssl (it also shows old root cert in a chain when executing `openssl s_client -showcerts -servername $HOST -connect $HOST:443`). Does heartbeat use openssl internally? Does it use some other CA certificate storage than the one in OS? When checking CA roots in SSL folder, I see "USERTrust" one is valid: ```auto ~$ ls /etc/ssl/certs -ag | grep USERTrust lrwxrwxrwx 1 root 76 Sep 3 2019 USERTrust_ECC_Certification_Authority.pem -> /usr/share/ca-certificates/mozilla/USERTrust_ECC_Certification_Authority.crt lrwxrwxrwx 1 root 76 Sep 3 2019 USERTrust_RSA_Certification_Authority.pem -> /usr/share/ca-certificates/mozilla/USERTrust_RSA_Certification_Authority.crt lrwxrwxrwx 1 root 41 Sep 3 2019 f30dd6ad.0 -> USERTrust_ECC_Certification_Authority.pem lrwxrwxrwx 1 root 41 Sep 3 2019 fc5a8f99.0 -> USERTrust_RSA_Certification_Authority.pem ``` ```auto ~$ openssl x509 -in /etc/ssl/certs/USERTrust_RSA_Certification_Authority.pem -noout -subject -dates subject=C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority notBefore=Feb 1 00:00:00 2010 GMT notAfter=Jan 18 23:59:59 2038 GMT ``` But when I connect and displaying the chain, it's not: Dump each one in chain: ```auto ~$ openssl s_client -showcerts -verify 5 -connect $HOST:443 < /dev/null | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".crt"; print >out}' ``` We need last one: ```auto ~$ openssl x509 -in cert3.crt -noout -subject -dates subject=C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority notBefore=May 30 10:48:38 2000 GMT notAfter=May 30 10:48:38 2020 GMT ``` Meanwhile, can I specify heartbeat to use only site level certificate dates somehow like it was before? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 10, 2020, 11:26am UTC](https://discuss.elastic.co/t/heartbeat-returns-wrong-x-509-information-tls-server-x509/251484/5 "2020-11-10T11:26:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.