# How to set the tls part in the filebeat.yml....alway wrong

**URL:** <https://discuss.elastic.co/t/how-to-set-the-tls-part-in-the-filebeat-yml-alway-wrong/67070>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 24, 2016, 8:21am UTC](https://discuss.elastic.co/t/how-to-set-the-tls-part-in-the-filebeat-yml-alway-wrong/67070 "2016-11-24T08:21:13Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![houfan](https://avatars.discourse-cdn.com/v4/letter/h/47e85d/32.png) [@houfan](https://discuss.elastic.co/u/houfan)\
**Post date:** [November 24, 2016, 10:40am UTC](https://discuss.elastic.co/t/how-to-set-the-tls-part-in-the-filebeat-yml-alway-wrong/67070/3 "2016-11-24T10:40:51Z")

</div>

realy realy thank  
my filebeat version is 1.3.1 logstash version is 2.4  
I don't know how many times I have tried having a self-signed server certificate, I always get a error:  
Looks like you either have an invalid key or your private key was not in PKCS8 format. {:exception=\>java.lang.IllegalArgumentException: File does not contain valid private key: /etc/server/key/server.key, :level=\>:error}

this is my command in order:  
_ **1.get a CA** _  
1.1 openssl genrsa -out ca.key 2048  
1.2 openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=CN/ST=guangdong/L=shenzhen/O=litianbl/OU=gamecenter"  
1.3.1 mkdir demoCA  
. . .2 cd demoCA/  
.....3 mkdir newcerts  
......4 touch index.txt  
......5 echo 01 \> serial  
_ **2. get server's certificates** _  
2.0 cd ..  
2.1 openssl genrsa -out server.key 2048  
2.2 openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=guangdong/L=shenzhen/O=litianbl/OU=gamecenter/CN=192.168.147.128"  
2.3 openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key  
2.4 openssl verify -CAfile ca.crt server.crt  
the console output after this command is: server.crt: OK  
**_3.get client's certificates_**  
3.1 openssl genrsa -out client.key 2048  
3.2 openssl req -new -key client.key -out client.csr -subj "/C=CN/ST=guangdong/L=shenzhen/O=litianbl/OU=gamecenter/CN=192.168.147.129"  
3.3 openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key  
3.4 openssl verify -CAfile ca.crt client.crt  
after this command ,the console output: client.crt: OK  
**_4. test_**  
4.1 open a terminal 1 and then :  
 openssl s\_server -accept 10001 -key server.key -cert server.crt 4.2 open a terminal 2 and then: openssl s\_client -connect localhost:10001  
I can get what I input in terminal 2 from terminal 1.and in another way I also can get what i input in terminal 1 from terminal 2.

so, I think these certificates are ok. and the I reconfigured the logstash.conf and filebeat.yml :  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/1/116ae844c4160cf5eb69854f1e4fd5eaed6402b6.png) ![](https://us1.discourse-cdn.com/elastic/original/2X/9/91b0f2dbb76cda064c95cf7ada5ca2f2eb7a8424.png)

and finaly I still get this........  
 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/0560b73bc795af28342bff372e2e33e7f360fbe0.png)

could you help me with this ..........please 😭😭😭 cos I have searched this error on the internet,but nothing I got.  
somebody help ......

---

_[View the full topic](https://discuss.elastic.co/t/how-to-set-the-tls-part-in-the-filebeat-yml-alway-wrong/67070)._