# Issues configuring SSL TCP Syslog Collection - Palo Alto Integration **URL:** \ **Category:** Elastic Agent\ **Created:** [July 28, 2023, 4:13pm UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572 "2023-07-28T16:13:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![elasticnub](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@elasticnub](https://discuss.elastic.co/u/elasticnub)\ **Post date:** [July 28, 2023, 4:13pm UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/1 "2023-07-28T16:13:25Z")
I am new to the Elastic ecosystem and looking for assistance...trying to configure tcp SSL collection for palo logs from cortex datalake... this cert worked fine with our previous solution so I know nothing is wrong with the cert within my SSL configuration from the palo tcp collection SSL Configuration ssl.certificate: "C:/path/to/cert/lr\_server.crt" ssl.certificate\_authorities: ["C:/path/to/cert/lr\_server.crt"] get the following error - [failed to reload inputs: 1 error: Error creating runner from config: type mismatch accessing 'ssl'] - when running netstat the agent isn't even listening on the port If I remove all SSL configuration - agent listens on port but is unable to decrypt the traffic 🙂 ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 29, 2023, 11:38pm UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/2 "2023-07-29T23:38:14Z")
Hi @elasticnub Welcome to the community and thanks for trying Elastic Agent integrations. I did a quick ask internally see what we get... did you try without the leading `ssl.` ```auto certificate: "C:/path/to/cert/lr_server.crt" certificate_authorities: ["C:/path/to/cert/lr_server.crt"] ``` Assume you are talking about this section ![Screenshot 2023-07-29 at 4.33.24 PM](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c11ff8eab30f668e26377643f19f22cc98462c2.png) I looked in the code [here](https://github.com/elastic/integrations/blob/main/packages/panw_cortex_xdr/data_stream/alerts/agent/stream/httpjson.yml.hbs) Which makes me think you may not need the leading `ssl.` ```auto {{#if ssl}} request.ssl: {{ssl}} {{/if}} ``` ---
**Author:** ![elasticnub](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@elasticnub](https://discuss.elastic.co/u/elasticnub)\ **Post date:** [July 30, 2023, 1:19am UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/3 "2023-07-30T01:19:54Z")
hey @stephenb - I have tried every which way possible including removing the SSL - the error messages are super generic and it appears I might be the only person on the internet with the error 🙂 - it should be noted that I am using the Palo Alto Next-Gen Firewall integration as we do not use cortex XDR, just global protect VPN service in the cloud. Do you have any idea where I can find information on the errors provided from the SSL configuration? I have tried path to certificates vs putting the cert within the SSL box. With any reference to certificates the agent will not open the port for listening. ```auto certificate: - | -----BEGIN CERTIFICATE----- blah blah blah -----END CERTIFICATE----- ``` Error with just certificate: "C:/path/to/cert/lr\_server.crt" ```auto [elastic_agent][error] Unit state changed tcp-default-tcp-panw-5a58e590-2be3-11ee-9f77-b1f9cdde8d8b (CONFIGURING->FAILED): [failed to reload inputs: 1 error: Error creating runner from config: can not convert 'object' into 'string' accessing 'ssl.certificate' accessing 'ssl'] ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 30, 2023, 3:00am UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/4 "2023-07-30T03:00:10Z")
Hi @elasticnub Ok so when I see this that looks to me that ![Screenshot 2023-07-29 at 7.45.09 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35795ac96793b0d5eb43faa900244d680dfbf601.png) a) you do not prefix with `ssl.` pretty sure,, that is what is throwing this error `can not convert 'object' into 'string' accessing 'ssl.certificate'` b) can you try this for just a test `verification_mode: none` ![Screenshot 2023-07-29 at 7.52.51 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04fedf683c7d8bc8fdb45abfa93ff6b2ed650d19.png) If that works then you need to understand what kind of validation your Palo Alto Server Side SSL Requires. Finally when I run into these hard-to-figure-out config and agent is hard to debug... I just do all the testing with a local filebeat then copy / move the config over to the agent... because agent is basically running filebeat under the covers. You can run [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-panw.html) in the foreground and see all the logs and test the modules etc... Use the [quickstart](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html) enable the correct module you can [test](https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html) all this ... then go back to agent... Not ideal but a suggestion Question do you understand the difference between a CA (Certificate Authority) and the Actual Cert? I ask because `certificate_authorities: ["C:/path/to/cert/lr_server.crt"]` That does not look like a CA, you will need to get the CA from your SSL person, you need to ask what type of SSL validation does that Palo Alto Server require from a connecting client. [Here](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html) is the description of all the SSL settings ---
**Author:** ![elasticnub](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@elasticnub](https://discuss.elastic.co/u/elasticnub)\ **Post date:** [July 30, 2023, 3:53am UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/5 "2023-07-30T03:53:52Z")
@stephenb - same issue with verification\_mode: none ```auto verification_mode: none certificate: - | -----BEGIN CERTIFICATE----- blah blah blah blah -----END CERTIFICATE----- ``` ```auto [elastic_agent][error] Unit state changed tcp-default (STARTING->FAILED): [failed to reload inputs: 1 error: Error creating runner from config: can not convert 'object' into 'string' accessing 'ssl.certificate' accessing 'ssl'] ``` I guess I am trying to figure out why the agent is not opening up the port for collection as debug logging still simply shows very generic errors. It has to not like something about the certificate to not open the port / start collection and I can't seem to find anything that tells me why. I guess I will explore manually running filebeat to see if debugging log gives any better hint as why the port would not be opening. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [July 30, 2023, 5:31am UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/6 "2023-07-30T05:31:01Z")
I meant just try the verification\_mode only It is not opening the port because it's failing to parse the configuration so it never gets that far.... If it fails parsing the configuration no port will be open because it does not get to that step. You even said above if you don't put in the SSL settings at the port opens. This is about parsing your configuration correctly. Your syntax is **not correct** Please see [here](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html) The config you show in the post above is for the field `certificate` which takes a single value. But the yml syntax You used is for an array / list, not a single entry so you use the syntax for `certificate_authority` which is a list which is not correct for the field `certificate` Which again correlates to the error exactly...The syntax is VERY specific Please try with **only** the verification mode first. Then if you add certificate or certificate authorities? Make sure you use the correct syntax. And of course the actual correct CA. Again... You would probably debug this quicker with filebeat ---
**Author:** ![kcreddy](https://avatars.discourse-cdn.com/v4/letter/k/6f9a4e/32.png) [@kcreddy](https://discuss.elastic.co/u/kcreddy)\ **Post date:** [July 30, 2023, 11:34am UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/7 "2023-07-30T11:34:16Z")
Here's a similar issue which was resolved with correct configuration. > [@Can not convert 'object' into 'string'](https://discuss.elastic.co/t/can-not-convert-object-into-string/97028): > > Getting these errors, did a ton of searching around but no luck. Running bitnam elki vm on debian. and filebeat on centos7. 2017-08-14T21:44:38Z INFO Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat] 2017-08-14T21:44:38Z INFO Setup Beat: filebeat; Version: 5.5.1 2017-08-14T21:44:38Z ERR failed to initialize logstash plugin as output: can not convert 'object' into 'string' accessing 'output.logstash.ssl.certificate' (sou… ---
**Author:** ![elasticnub](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@elasticnub](https://discuss.elastic.co/u/elasticnub)\ **Post date:** [July 30, 2023, 5:14pm UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/8 "2023-07-30T17:14:35Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d3e821bd0e47a7e851e5605cec47c14f7cd3af4b.png) ```auto [elastic_agent][error] Unit state changed tcp-default-tcp-panw-5a58e590-2be3-11ee-9f77-b1f9cdde8d8b (CONFIGURING->FAILED): [failed to reload inputs: 1 error: Error creating runner from config: certificate file not configured accessing 'ssl'] ``` Fails to open the port with this configuration also. Where are you seeing incorrect syntax? Because I included SSL? I mentioned I tried it with / without and same outcome. I tried referencing the path and also tried the certificate syntax by putting it directly within the yaml file. The CA is in the trust store on the machine but I exported it to specify the path within the SSL configuration file. Could you show me what you think the correct syntax is? Guess I am confused as all the different syntax methods I have tried shows as being supported. ---
**Author:** ![elasticnub](https://avatars.discourse-cdn.com/v4/letter/e/b9e5f3/32.png) [@elasticnub](https://discuss.elastic.co/u/elasticnub)\ **Post date:** [July 30, 2023, 6:01pm UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/9 "2023-07-30T18:01:35Z")
woohoo got it working thanks @stephenb / @kcreddy for the help! My configuration file is below ```auto certificate: "C:/Users/path/to/file/lr_server.cer" key: "C:/Users/path/to/file/agent_key_noenc.key" ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 27, 2023, 6:02pm UTC](https://discuss.elastic.co/t/issues-configuring-ssl-tcp-syslog-collection-palo-alto-integration/339572/10 "2023-08-27T18:02:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.