# How should I configure TLS?

**URL:** <https://discuss.elastic.co/t/how-should-i-configure-tls/349431>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 15, 2023, 8:00am UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431 "2023-12-15T08:00:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hamada](https://avatars.discourse-cdn.com/v4/letter/h/ac91a4/32.png) [@Hamada](https://discuss.elastic.co/u/Hamada)\
**Post date:** [December 15, 2023, 8:00am UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431/1 "2023-12-15T08:00:30Z")

</div>

I don't know how to set up a certificate to connect Winlogbeat to Elasticsearch via https.

What should I do to create a PEM file from the CA (http.p12) created at initial startup?

I don't understand what is required in the following steps.

===  
Connect clients to Elasticsearchedit  
When you start Elasticsearch for the first time, TLS is configured automatically for the HTTP layer. A CA certificate is generated and stored on disk at:

/etc/elasticsearch/certs/http\_ca.crt  
The hex-encoded SHA-256 fingerprint of this certificate is also output to the terminal. Any clients that connect to Elasticsearch, such as the Elasticsearch Clients, Beats, standalone Elastic Agents, and Logstash must validate that they trust the certificate that Elasticsearch uses for HTTPS. Fleet Server and Fleet-managed Elastic Agents are automatically configured to trust the CA certificate. Other clients can establish trust by using either the fingerprint of the CA certificate or the CA certificate itself.

If the auto-configuration process already completed, you can still obtain the fingerprint of the security certificate. You can also copy the CA certificate to your machine and configure your client to use it.

> **[Start the Elastic Stack with security enabled automatically | Elasticsearch...](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-stack-security.html#_connect_clients_to_elasticsearch_5)**

===

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 17, 2023, 7:27pm UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431/2 "2023-12-17T19:27:13Z")

</div>

Follow these instructions:

> **[Configure SSL | Winlogbeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-ssl.html)**

Either

a) Copy `/etc/elasticsearch/certs/http_ca.crt` to each winlogbeat host and then reference that copy in this setting (and yes that `http_ca.crt` is a `.pem`

`output.elasticsearch.ssl.certificate_authorities: ["/etc/client/http_ca.crt"]`

b) Generate the SHA-256 fingerprint with the instructions that you referenced above and set that with

`openssl x509 -fingerprint -sha256 -noout -in /etc/elasticsearch/certs/http_ca.crt | awk --field-separator="=" '{print $2}' | sed 's/://g'`

`output.elasticsearch.ssl.ca_trusted_fingerprint: "thereallylongfingerprintfromthecommandabove`

c) Not recommended set

`output.elasticsearch.ssl.verification_mode: none`

---

<div class="post-metadata">

**Author:** ![Hamada](https://avatars.discourse-cdn.com/v4/letter/h/ac91a4/32.png) [@Hamada](https://discuss.elastic.co/u/Hamada)\
**Post date:** [December 19, 2023, 7:02am UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431/3 "2023-12-19T07:02:58Z")

</div>

Thanks to you, this problem was solved

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 19, 2023, 7:14am UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431/4 "2023-12-19T07:14:02Z")

</div>

> [@Hamada](#):
>
> Thanks to you, this problem was solved

Hi @Hamada  
What was your solution... It may help others.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2024, 9:14am UTC](https://discuss.elastic.co/t/how-should-i-configure-tls/349431/5 "2024-01-16T09:14:25Z")

</div>

Closed on January 16, 2024, 9:14am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.