# Logstash 7.8.1 Beats Input Plugin does not reload TLS certificate on change
**URL:** https://discuss.elastic.co/t/logstash-7-8-1-beats-input-plugin-does-not-reload-tls-certificate-on-change/247578
**Category:** Logstash
**Created:** [September 4, 2020, 5:15pm UTC](https://discuss.elastic.co/t/logstash-7-8-1-beats-input-plugin-does-not-reload-tls-certificate-on-change/247578 "2020-09-04T17:15:38Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)
#### Post date: [September 4, 2020, 5:15pm UTC](https://discuss.elastic.co/t/logstash-7-8-1-beats-input-plugin-does-not-reload-tls-certificate-on-change/247578/1 "2020-09-04T17:15:38Z")
Hi Elastic Experts,
I recently upgraded from Logstash 6.8.7 to Logstash 7.8.1, and notice the TLS Certificate on change is not reloaded by Beats Input.
I need Logstash Beats Input to reload the renewed certificate, when the expired certificate is replaced by new valid certificate.
Logstash 6.8.7 the certificate reload was working, but after upgrade to Logstash 7.8.1 which contains Beats Input Plugin version: v6.0.11, the certificate reload seems does not work. On expiry of certificate, when certificate is replaced with renewed certificate, the plugin does not read new certificate.
> [2020-09-04T20:32:10,872][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5044, remote: 192.168.200.70:50062] Handling exception: javax.net.ssl.SSLException: Received fatal alert: bad\_certificate
> [2020-09-04T20:32:10,872][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
> io.netty.handler.codec.DecoderException: javax.net.ssl.SSLException: Received fatal alert: bad\_certificate
> at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:650) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:576) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.49.Final.jar:4.1.49.Final]
> at java.lang.Thread.run(Thread.java:748) [?:1.8.0\_252]
> Caused by: javax.net.ssl.SSLException: Received fatal alert: bad\_certificate
> at sun.security.ssl.Alerts.getSSLException(Alerts.java:214) ~[?:1.8.0\_252]
> at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1667) ~[?:1.8.0\_252]
> at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1635) ~[?:1.8.0\_252]
> at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1801) ~[?:1.8.0\_252]
> at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1090) ~[?:1.8.0\_252]
> at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:913) ~[?:1.8.0\_252]
> at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:783) ~[?:1.8.0\_252]
> at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:626) ~[?:1.8.0\_252]
> at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:282) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1372) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1267) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1314) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:501) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:440) ~[netty-all-4.1.49.Final.jar:4.1.49.Final]
> ... 17 more
Filebeat is rejecting Logstash certificate as invalid or expired. However certificate are valid and placed at location from where Logstash is configured to read certificate.
This use to work before upgrade with Logstash 6.8.7/
Can guidance on this issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 2, 2020, 5:15pm UTC](https://discuss.elastic.co/t/logstash-7-8-1-beats-input-plugin-does-not-reload-tls-certificate-on-change/247578/2 "2020-10-02T17:15:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.