# How to generate certs for Filebeats with elasticsearch-certutil?

**URL:** <https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 17, 2020, 9:07am UTC](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618 "2020-07-17T09:07:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 17, 2020, 9:07am UTC](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618/1 "2020-07-17T09:07:35Z")

</div>

Dears,

I would like to generate the certs for filebeats service and when I try to do this:  
`/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /etc/elasticsearch/certs/ca.crt`

I've got error message:

```auto
Enter password for CA (/etc/elasticsearch/certs/ca.crt) :
Exception in thread "main" java.io.IOException: toDerInputStream rejects tag type 45
at java.base/sun.security.util.DerValue.toDerInputStream(DerValue.java:858)
at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1982)
at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222)
at java.base/java.security.KeyStore.load(KeyStore.java:1472)
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyStore(CertParsingUtils.java:75)
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyPairsFromKeystore(CertParsingUtils.java:141)
at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readPkcs12KeyPairs(CertParsingUtils.java:134)
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.lambda$loadPkcs12CA$1(CertificateTool.java:342)
at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:933)
at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:85)
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.loadPkcs12CA(CertificateTool.java:341)
at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.getCAInfo(CertificateTool.java:329)
at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:685)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:91)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125)
at org.elasticsearch.cli.Command.main(Command.java:90)
at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:137)

```

There no password for ca.crt. Do you have any idea what is wrong?

The ca was generated with --keep-ca-key option.

Best Regards,  
Dan

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 17, 2020, 10:47am UTC](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618/2 "2020-07-17T10:47:28Z")

</div>

The `--ca` option requires a PKCS#12 file but you appear to be providing a PEM certificate  
You want to use `--ca-cert` and `--ca-key`

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 17, 2020, 10:48am UTC](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618/3 "2020-07-17T10:48:42Z")

</div>

@TimV you are right. Thank you very much.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2020, 10:48am UTC](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618/4 "2020-08-14T10:48:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.