# Logstash 2.0.0 SSLError: Socket closed

**URL:** <https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748>\
**Category:** Logstash\
**Created:** [November 4, 2015, 2:19pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748 "2015-11-04T14:19:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\
**Post date:** [November 4, 2015, 2:19pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748/1 "2015-11-04T14:19:53Z")

</div>

I am receiving an SSL socket error when using the new Logstash 2.0.0.

My configuration:

NXLog conf:

```
<Input network>
        Module im_tcp
        Host 0.0.0.0
        Port 1514
        Exec parse_json();		
</Input>

<Output ssllogstash>
    Module om_ssl
    Host ourlogstashhost
    Port 3515
    CAFile %ROOT%/cert/someca.crt 
    CertFile %ROOT%/cert/somecert.crt
    OutputType LineBased
</Output>

<Route 66>
    Path network => buffer => ssllogstash
</Route>

```

Logstash configuration:

```
input {
  tcp {
    codec => json { charset => "CP1252" }
    port => 3515
    type => "nxlog"
    ssl_cacert => "someca.crt"
    ssl_cert => "somecert.crt"
    ssl_key => "somekey.key"
    ssl_enable => true
  }
}
output {
  elasticsearch {
        hosts => ["host1:9200", "host2:9200", "host3:9200"]
}

```

Logstash log:

```
{:timestamp=>"2015-11-04T14:28:16.185000+0100", :message=>"SSL Error", :exception=>#<OpenSSL::SSL::SSLError: Socket closed>, :backtrace=>["org/jruby/ext/openssl/SSLSocket.java:262:in `accept'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/jruby-openssl-0.9.12-java/lib/jopenssl19/openssl/ssl-internal.rb:106:in `accept'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-2.0.4/lib/logstash/inputs/tcp.rb:108:in `run_server'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-tcp-2.0.4/lib/logstash/inputs/tcp.rb:80:in `run'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:180:in `inputworker'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.0.0-java/lib/logstash/pipeline.rb:174:in `start_input'"], :level=>:error}

```

Eventually logstash crashes and stops the log flow.  
Any insight?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 4, 2015, 7:05pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748/2 "2015-11-04T19:05:01Z")

</div>

Perhaps s\_client would be useful for debugging this?

I recommend you to use absolute paths to the certificate files. Do not rely on Logstash's current directory.

---

<div class="post-metadata">

**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\
**Post date:** [November 4, 2015, 8:43pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748/3 "2015-11-04T20:43:12Z")

</div>

Hi Magnus, I can connect to the logstash using the s\_client, the still throws errors, but connection is held until logstash crashes.  
I am using full path in the real conf, just sanitized it a bit for the forum 🙂

Any insight??

---

<div class="post-metadata">

**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\
**Post date:** [November 10, 2015, 12:42pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748/4 "2015-11-10T12:42:24Z")

</div>

Any insight?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/logstash-2-0-0-sslerror-socket-closed/33748/5 "2017-07-06T05:23:17Z")

</div>