# Logstash beats input cant start with ssl enabled

**URL:** <https://discuss.elastic.co/t/logstash-beats-input-cant-start-with-ssl-enabled/249633>\
**Category:** Logstash\
**Created:** [September 23, 2020, 9:56am UTC](https://discuss.elastic.co/t/logstash-beats-input-cant-start-with-ssl-enabled/249633 "2020-09-23T09:56:28Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![dorinand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorinand/32/70521_2.png) [@dorinand](https://discuss.elastic.co/u/dorinand)\
**Post date:** [September 28, 2020, 7:10am UTC](https://discuss.elastic.co/t/logstash-beats-input-cant-start-with-ssl-enabled/249633/5 "2020-09-28T07:10:50Z")

</div>

**SOLUTION:**

So the problem was `invalid private key`. I set up [debug log level](https://www.elastic.co/guide/en/logstash/7.8/logging.html) for logstash in `logstash.yml`:

`log.level: debug`

Then, in all debug messages, there was message about `invalid private key`. At first, this should be mentioned, according to me, in INFO logs. The certificate, as I mentioned above, is valid, but the format of certificate was wrong. So from [documentation](https://www.elastic.co/guide/en/logstash/7.8/plugins-inputs-beats.html#plugins-inputs-beats-ssl_key) of input beats:

> SSL key to use. NOTE: This key need to be in the PKCS8 format, you can convert it with [OpenSSL](https://www.openssl.org/docs/man1.1.0/apps/pkcs8.html) for more information.

So I change format with:

`openssl pkcs8 -topk8 -nocrypt -in instance.key -out instance.key.pkcs8`

And change my configuration of input beats:

```
input {
  beats {
    port => 5000
    ssl => true
    ssl_certificate => "/ssl/instance.crt"
    ssl_key => "/ssl/instance.key.pkcs8"
  }
}

```

Than it starts to work. Everywhere in cluster (filebeat, elasticsearch) was this cert valid, but for logstash, there must be different format.

---

_[View the full topic](https://discuss.elastic.co/t/logstash-beats-input-cant-start-with-ssl-enabled/249633)._