# Logstash and PKCS#12 format

**URL:** <https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [August 26, 2020, 6:07pm UTC](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499 "2020-08-26T18:07:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Post date:** [August 26, 2020, 6:07pm UTC](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499/1 "2020-08-26T18:07:24Z")

</div>

Hi,

\*Running ELK 7.9

I am in the process of securing my ELK nodes and I have been struggling with the security settings for the last few days. After spending some time on this, I finally have Elasticsearch and Kibana configured for secure connection and both using certificates in `PKCS#12` format.

Most of the documentation found around the web explain how to configure Kibana to use only `PEM` format, and so with Logstash, but I was wondering if like Kibana, Logstash is now able to handle `PKCS#12`. I would like to use the `PKCS#12` format (if possible) to make my config simpler.

- Is Logstash now able to handle `PKCS#12` format?  
If YES, please help me with the right steps and config sample.

## Documentation used

[https://www.elastic.co/guide/en/elasticsearch/reference/7.9/configuring-tls.html#tls-http](https://www.elastic.co/guide/en/elasticsearch/reference/7.9/configuring-tls.html#tls-http)  
[https://www.elastic.co/guide/en/logstash/current/ls-security.html](https://www.elastic.co/guide/en/logstash/current/ls-security.html)

> **[Configuring SSL, TLS, and HTTPS to secure Elasticsearch, Kibana, Beats, and...](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash)**
>
> Feeling insecure about your Elastic Stack security? Run through these step-by-step instructions for setting up TLS encryption and https on Elasticsearch, Kibana, Logstash, and Beats to shore up your stack's defenses. Highly recommended for end-to-end...

  

> **[How to secure your Elastic Stack (plus Kibana, Logstash and Beats) | Official...](https://blog.pythian.com/how-to-secure-your-elastic-stack-plus-kibana-logstash-and-beats/?unapproved=9658026&moderation-hash=32a1628d01b1888f782c421dd54698b3#comment-9658026)**
>
> In this second post of a series on Elastic Stack, Alejandro Gonzalez explains how to secure your Elastic Stack using HTTPS, SSL and TLS.

Thank you

\*This is the current config that I am trying , but not working so far....

- My `truststore` is not password protected at the moment (password is an empty string)

## logstash.yml

```
xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.hosts: ["https://localhost:9200"]
xpack.monitoring.elasticsearch.username: "logstash_system"
xpack.monitoring.elasticsearch.password: " *******************"
xpack.monitoring.elasticsearch.ssl.truststore.path: "/etc/logstash/certs/elastic-certificates.p12"
xpack.monitoring.elasticsearch.ssl.keystore.path: "/etc/logstash/certs/elastic-certificates.p12"
xpack.monitoring.elasticsearch.ssl.verification_mode: certificate

```

## Pipeline config file

```
 output {
       elasticsearch {
        hosts => "https://127.0.0.1:9200"
        index => "[some index]"
        template_overwrite => true
        template => "[some template]"
        user => "logstash_internal"
        password => " ******************"
        keystore => "/etc/logstash/certs/elastic-certificates.p12"
        truststore => "/etc/logstash/certs/elastic-certificates.p12"
        }
 }

```

## Log output

```
[2020-08-26T13:13:14,528][INFO][logstash.runner] Starting Logstash {"logstash.version"=>"7.9.0", "jruby.version"=>"jruby 9.2.12.0 (2.5.7) 2020-07-01 db01a49ba6 OpenJDK 64-Bit Server VM 11.0.8+10-post-Debian-1deb10u1 on 11.0.8+10-post-Debian-1deb10u1 +indy +jit [linux-x86_64]"}
[2020-08-26T13:13:15,912][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"undefined method `toCharArray' for nil:NilClass"}
[2020-08-26T13:13:15,948][ERROR][logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.
[2020-08-26T13:13:19,009][INFO][org.reflections.Reflections] Reflections took 30 ms to scan 1 urls, producing 22 keys and 45 values
[2020-08-26T13:13:19,631][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2020-08-26T13:13:19,848][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600}
[2020-08-26T13:13:24,903][INFO][logstash.runner] Logstash shut down.
[2020-08-26T13:13:24,922][ERROR][org.logstash.Logstash] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
```

---

<div class="post-metadata">

**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Post date:** [August 27, 2020, 7:25pm UTC](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499/2 "2020-08-27T19:25:48Z")

</div>

## Update

I have been trying the PEM/CRT format. I keep the certificate in `.pk12` format that works great for Elasticsearch and Kibana, and then extract the cert and key in PEM format for Logstash.

For key

`sudo openssl pkcs12 -in /etc/elasticsearch/certs/elastic-stack-ca.p12 -out /etc/elasticsearch/certs/elastic-stack-ca.key -nodes -nocerts`

For cert

```
sudo openssl pkcs12 -in /etc/elasticsearch/certs/elastic-stack-ca.p12 -out /etc/elasticsearch/certs/elastic-stack-ca-public.crt -nokeys
sudo openssl pkcs12 -in /etc/elasticsearch/certs/elastic-stack-ca.p12 -out /etc/elasticsearch/certs/elastic-stack-ca-public.pem -clcerts -nokeys -chain

```

Logstash is able to connect to Elasticsearch for monitoring and to process the pipelines using a security certificate (either `.cert` or `.pem`), but only if I disable the verification in both settings:

## logstash.yml

`xpack.monitoring.elasticsearch.ssl.verification_mode: certificate`

## Pipeline config file

`ssl_certificate_verification => false`

So, Logstash seems to be working with the certificates (somehow), but I get warnings due to the verification being disabled, which is risky:

```
[2020-08-27T15:07:08,081][WARN][logstash.outputs.elasticsearch][main] **WARNING** Detected UNSAFE options in elasticsearch output configuration!
**WARNING** You have enabled encryption but DISABLED certificate verification.
**WARNING** To make sure your data is secure change :ssl_certificate_verification to true

```

Am I doing something wrong?  
I would like to use `.pk12` format for all configs, but it looks like Logstash can't handle that format yet. So for this one I have to use the other format, but I would like to use at least the minimal verification.

Can someone help me?

Thank you

---

<div class="post-metadata">

**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\
**Post date:** [August 27, 2020, 8:05pm UTC](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499/3 "2020-08-27T20:05:51Z")

</div>

## Update

This [thread](https://discuss.elastic.co/t/certificates-and-keys-for-kibana-and-logstash-with-x-pack/150390/7) describes my issue as I'm having the same issue with the "CN=instance", but I am running Elasticsearch, Kibana and Logstash on the same machine, and users access Kibana by IP address (https://IP\_address:5601), so I don't have a FQDM.

Logstash connects to Elasticsearch using `localhost` or `127.0.0.1`

`xpack.monitoring.elasticsearch.hosts: ["https://127.0.0.1:9200"]`

```
elasticsearch {
     hosts => "https://127.0.0.1:9200"

```

What should I put after `--dns`? Should I use the IP address when generating the cert?

```auto
bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --dns IP_address

```

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2020, 8:05pm UTC](https://discuss.elastic.co/t/logstash-and-pkcs-12-format/246499/4 "2020-09-24T20:05:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.