# Java APM Agent connecting to SSL APM Server **URL:** \ **Category:** APM\ **Tags:** elastic-stack-security, java\ **Created:** [November 3, 2021, 6:03pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355 "2021-11-03T18:03:11Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Trinity\_Rolling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trinity_rolling/32/96443_2.png) [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Post date:** [November 3, 2021, 6:03pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/1 "2021-11-03T18:03:11Z")
**Kibana version** : 7.15.1 **Elasticsearch version** : 7.15.1 **APM Server version** : 7.15.1 **APM Agent language and version** : Java 1.26.0 **Browser version** : Chrome 94.0.4606.81 **Is there anything special in your setup?** Windows based, Windows Certificate Authority, SSL Certificates, Single node **Description of the problem including expected versus actual behavior. Please include screenshots (if relevant)**: APM Agent not communicating with APM Server. **Provide logs and/or server output (if relevant)**: 1. Where to find logs from APM Agent on APM Agent host if APM isn't communicating with the APM Server? Documentation for securing APM Agent is vague. ([SSL/TLS communication with APM Server | APM Java Agent Reference [1.x] | Elastic](https://www.elastic.co/guide/en/apm/agent/java/current/ssl-configuration.html#ssl-client-authentication)) Am I modifying my application's keystore in order to report back to the APM Server? This seems very intrusive and could potentially be a breaking change for the application especially an application that already uses SSL. ---
**Author:** ![riferrei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/riferrei/32/104867_2.png) [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Post date:** [November 3, 2021, 7:48pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/2 "2021-11-03T19:48:24Z")
Could you share a stacktrace from the JVM agent to better understand what is happening during the communication? If possible, please share as well your `apm-server.yml` configuration file. Also, if you suspect that the problem is related to certificate validation, you can temporarily disable this behavior by using the following property in the JVM agent: ```auto -Delastic.apm.verify_server_cert=false ``` It might be helpful to isolate the issue and see if cert mgmt is indeed what is causing the problem. — @riferrei ---
**Author:** ![Trinity\_Rolling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trinity_rolling/32/96443_2.png) [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Post date:** [November 3, 2021, 8:51pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/3 "2021-11-03T20:51:45Z")
I will start with adding the verify\_server\_cert=false to make sure there is not a certificate issue. Many of the examples and tutorials show the APM Server as localhost. Is an APM Server required on each application host? I currently only have the APM Agent using the following settings with TomCat that runs as a Windows Service pointing to a remote APM Server. ```auto -javaagent:E:\tomcat\elastic-apm\elastic-apm-agent-1.26.0.jar \ -Delastic.apm.service_name=myapp -Delastic.apm.server_urls=https://elasticstack.mydomaincom:8200 \ -Delastic.apm.secret_token= AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2Vu... \ -Delastic.apm.environment=ist \ -Delastic.apm.application_packages=com.mydomain.myapp \ ``` apm-server.yml ```auto apm-server: host: "0.0.0.0:8200" auth: secret_token: AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2MzU0N... #---------------------------- APM Server - Secure Communication with Agents ---------------------------- ssl: enabled: true certificate: 'D:\Elasticsearch\config\elastic-server.cer' key: 'D:\Elasticsearch\config\elastic-server.key' supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3] apm-server.auth.secret_token: AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3R... #---------------------------- APM Server - Agent Configuration ---------------------------- agent.config.cache.expiration: 30s kibana: enabled: true host: "https://elasticstack.phmic.com:5601" protocol: "https" username: "" password: "" ssl.enabled: true ssl.verification_mode: certificate ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] ssl.certificate_authorities: 'D:\Elasticsearch\config\certauth-root.cer' ssl.certificate: 'D:\Elasticsearch\config\kibana-server.cer' ssl.key: 'D:\Elasticsearch\config\kibana-server.key' #---------------------------- APM Server - ILM Index Lifecycle Management ---------------------------- ilm: enabled: "auto" setup: enabled: true overwrite: true #-------------------------- Elasticsearch output -------------------------- output.elasticsearch: hosts: ["https://elasticstack.mydomain.com:9200"] enabled: true compression_level: 0 protocol: "https" username: "" password: "" worker: 1 pipeline: "apm" ssl.enabled: true ssl.verification_mode: full ssl.supported_protocols: [TLSv1.0, TLSv1.1, TLSv1.2] ssl.certificate_authorities: 'D:\Elasticsearch\config\certauth-root.cer' ssl.certificate: 'D:\Elasticsearch\config\elastic-server.cer' ssl.key: 'D:\Elasticsearch\config\elastic-server.key' ``` ---
**Author:** ![Trinity\_Rolling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trinity_rolling/32/96443_2.png) [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Post date:** [November 3, 2021, 9:11pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/4 "2021-11-03T21:11:44Z")
```auto -Delastic.apm.verify_server_cert=false ``` This setting did the trick! What does that do for our traffic between the APM Agent and server? Is this now treated and unencrypted traffic? ---
**Author:** ![riferrei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/riferrei/32/104867_2.png) [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Post date:** [November 3, 2021, 9:19pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/5 "2021-11-03T21:19:53Z")
This property essentially disables the APM server authentication, which includes SSL certificate validation on the client. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 3, 2021, 9:24pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/6 "2021-11-03T21:24:18Z")
> [@Trinity\_Rolling](#): > > This setting did the trick! What does that do for our traffic between the APM Agent and server? Is this now treated and unencrypted traffic? The traffic is still encrypted just the server cert is just not validated on the client side. ---
**Author:** ![Trinity\_Rolling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trinity_rolling/32/96443_2.png) [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Post date:** [November 3, 2021, 9:30pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/7 "2021-11-03T21:30:50Z")
I'll be honest. I've been struggling with this for a couple days now and this was my Hail Mary before giving up on Elastic. Thank you for your guidance. I still want a server side validation between the client and server, but I will need to involve our code team in order to touch the keystore of this application. Very early stages of a secured on-prem setup. Thank you again! ---
**Author:** ![riferrei](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/riferrei/32/104867_2.png) [@riferrei](https://discuss.elastic.co/u/riferrei)\ **Post date:** [November 3, 2021, 9:38pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/8 "2021-11-03T21:38:26Z")
We're happy to help you 🤗 ![dont-give-up-on-me-give-me-a-chance](https://us1.discourse-cdn.com/elastic/original/3X/7/9/79463b460906c3abb572a4d8a3278b7566cd0def.gif) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 3, 2021, 10:30pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/9 "2021-11-03T22:30:32Z")
The other way is just to make sure you have an official CA certificate then it should be fine I believe. The other way and I'm not an expert at this is right it's get the CA from your internal certificate get it into the Java SSL key store and then it would probably work as well ---
**Author:** ![Trinity\_Rolling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trinity_rolling/32/96443_2.png) [@Trinity\_Rolling](https://discuss.elastic.co/u/Trinity_Rolling)\ **Post date:** [November 4, 2021, 1:58pm UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/10 "2021-11-04T13:58:43Z")
I was thinking about this last evening and I think using the central CA should resolve this issue. Our development environment used a different CA for some reason or another. That flag is magic though. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 25, 2021, 9:59am UTC](https://discuss.elastic.co/t/java-apm-agent-connecting-to-ssl-apm-server/288355/11 "2021-11-25T09:59:01Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.