# Logstash / Beats Encryption Error

**URL:** <https://discuss.elastic.co/t/logstash-beats-encryption-error/340140>\
**Category:** Logstash\
**Created:** [August 4, 2023, 1:44pm UTC](https://discuss.elastic.co/t/logstash-beats-encryption-error/340140 "2023-08-04T13:44:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![WLhelp](https://avatars.discourse-cdn.com/v4/letter/w/858c86/32.png) [@WLhelp](https://discuss.elastic.co/u/WLhelp)\
**Post date:** [August 4, 2023, 1:44pm UTC](https://discuss.elastic.co/t/logstash-beats-encryption-error/340140/1 "2023-08-04T13:44:09Z")

</div>

Hey folks,

i have trouble setting up encryption for Beats send to logstash server.

Test Config says "ok", test output on the client gives me:  
logstash: 10.1.7.27:5044...  
connection...  
parse host... OK  
dns lookup... OK  
addresses: 10.1.7.27  
dial up... OK  
TLS...  
security: server's certificate chain verification is enabled  
handshake... ERROR tls: invalid signature by the server certificate: crypto/rsa: verification error

relevant winlogbeat.yml entries:

```auto
output.logstash:
  hosts: ["1.2.3.4:5044"] #example IP
  ssl.certificate_authorities: ["C:/ProgramData/Elastic/Beats/winlogbeat/neu20230804/org_ca.crt"]
  ssl.certificate: "C:/ProgramData/Elastic/Beats/winlogbeat/neu20230804/client_combined.crt"
  ssl.key: "C:/ProgramData/Elastic/Beats/winlogbeat/neu20230804/client.key"

```

Logstash Input Config:

```auto
 input {
      beats {
         port => "5044"
         ssl => true
         ssl_certificate_authorities => ["/usr/share/logstash/certs/logstash_combined.crt"]
         ssl_certificate => "/usr/share/logstash/certs/org_ca.crt"
         ssl_key => "/usr/share/logstash/certs/logstash.key"      
         tags => ["beat-ext"]
        }
     }

```

Logstash is part of a securityonion installation, but that should make no real difference i guess.

Any Ideas what I am missing?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2023, 1:44pm UTC](https://discuss.elastic.co/t/logstash-beats-encryption-error/340140/2 "2023-09-01T13:44:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.