# Logstash certificate not trusted **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 21, 2015, 4:57pm UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701 "2015-10-21T16:57:04Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![blackBagel](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@blackBagel](https://discuss.elastic.co/u/blackBagel)\ **Post date:** [October 21, 2015, 4:57pm UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/1 "2015-10-21T16:57:04Z")
Hey there, For some reason, I can't seem to be able to get my logstash to send trusted certificates to my secured elasticsearch cluster. My cluster is secured with HTTPS, plus PKI authentication for clients. I've followed your instructions in [https://www.elastic.co/guide/en/shield/current/logstash.html](https://www.elastic.co/guide/en/shield/current/logstash.html) but to no avail. No matter how I try to play with my logstash configuration, my certificates just don't seem to be trusted by my cluster. I've obviously checked, and my certificates work just fine using curl or kibana. I know my certificate is not trusted since i get these errors: **sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target** - on logstash. And **javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown** - on elastic. I've built my logstash keystore using these commands: **openssl pkcs12 -export -in mycert.crt -inkey mykey.key -out logstash.p12 -alias logstash** **keytool -importkeystore -srckeystore logstash.p12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS -alias logstash** And I obviously made sure my key's password is the same as my keystore's. I also tried to generate my keystore using only the crt as a trusted certificate using this command: **keytool -importcert -keystore keystore.jks -file logstash.crt -alias logstash** But it didn't work either. I'm a bit new to the PKI principles but as far as I understand, my first way should have worked just fine,,, ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [October 21, 2015, 5:49pm UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/2 "2015-10-21T17:49:41Z")
Can you provide your logstash configuration, shield configuration, and the output of `keytool -list -v keystore.jks`? With that hopefully we'll be able to figure out more of what's going wrong. ---
**Author:** ![soodlikesjava](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Post date:** [October 22, 2015, 4:27am UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/3 "2015-10-22T04:27:01Z")
I was facing the same issue today but my issue was with Self signed Certificates and i analysed that cacert param was having incorrect cert in logstash ElasticSearch output plugin . You need to copy the ES certs to your Logstash clients and mention the path of server certs in cacert attribute of ES output plugin . output { elasticsearch { ssl =\> true cacert =\>path to your self signed es server cert pem or Certifying Auth Cert shared by CA. } ---
**Author:** ![soodlikesjava](https://avatars.discourse-cdn.com/v4/letter/s/ee7513/32.png) [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Post date:** [October 22, 2015, 4:28am UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/4 "2015-10-22T04:28:04Z")
For PKI auth I have raised an issue which you can follow here > [@PKI authentication in logstash Elastic Search Output not working](https://discuss.elastic.co/t/pki-authentication-in-logstash-elastic-search-output-not-working/32738): > > Hi all, I am trying to achieve PKI auth in Logstash elastic search output plugin using shield trail license .Below are my configs Logstash : output { elasticsearch { cluster =\> "abc" host =\> ["host1","host2:port"] protocol : "http" ssl =\> true keystore =\> "/etc/pki/logstashStr.jks" keystore\_password =\> "\*\*\*\*\*" cacert =\> "etc/pki/servercert.crt" index =\> "logstash-mm-dd-yyyy" Still the exception is coming in logstash logs as : AuthenticationException[missing Authentication token for … ---
**Author:** ![blackBagel](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@blackBagel](https://discuss.elastic.co/u/blackBagel)\ **Post date:** [October 22, 2015, 8:14am UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/5 "2015-10-22T08:14:54Z")
Logstash configuration: input { file { path =\> "/tmp/hello\_world" type =\> "hello\_world" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } output { if [type] == "hello\_world" { elasticsearch { host =\> "xxx.xxx.xxx.xxx" port =\> 9200 protocol =\> "http" index =\> "hello\_world" document\_type =\> "hello" manage\_template =\> false ssl =\> true keystore =\> "/path/to/keystore" keystore\_password =\> "changeme" cacert =\> "/path/to/cert" } } } keytool -list -v -keytore /path/to/keystore: Keystore type: JKS Keystore provider: SUN Your keystore contains 1 entry Alias name: logstash Creation date: Oct 18, 2015 Entry type: PrivateKeyEntry Certificate chain length: 1 Certificate[1]: Owner: CN=My-AD-group, OU=MyDepartment, O=AcmeInc, C=US Issuer: CN=OurCA, OU=MyDepartment, O=AcmeInc, C=US Serial number: SomeHexaCode Valid from: Wed Jul 08 17:08:35 AKDT 2015 until: Sat Aug 24 17:08:35 AKDT 2017 Certificate fingerprints: MD5: 55:20:B2:68:FD:0F:4E:BF:D5:E5:D5:04:47:6C:E3:10 SHA1: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5 SHA256: 25:17:A0:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7:4B:50:FE:E5:CA:86:CC:3E:6C:2D:C0:4E:8D:E8:33:05:F7 Signature algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: 9.8.9.6.4.3.564.34.12 Criticality=false 0000: 29 8B 7F 4A 53 C3 D6 67 29 8B 7F 4A 53 C3 D6 67 some\_map 0010: 29 8B 7F 4A 53 C3 D6 67 29 8B 7F 4A some\_map #2: ObjectId: 9.8.9.6.4.3.564.34.12 Criticality=false 0000: 29 8B 7F 4A 53 C3 D6 67 29 8B 7F 4A 53 C3 D6 67 some\_map 0010: 29 8B 7F 4A 53 C3 D6 67 29 8B 7F 4A 53 C3 D6 67 some\_map 0020: 29 8B 7F 4A 53 C3 D6 67 29 8B 7F 4A 53 C3 D6 67 some\_map 0030: 29 some\_map #3: ObjectId: 9.8.9.6.4.3.564.34.12 Criticality=false 0000: 29 8B 7F 4A 53 C3 D6 67 29 8B 7F 4A 53 C3 D6 67 Acme Service Auth 0010: 29 8B 7F 4A 53 C3 D6 67 29 8B entication #4: ObjectId: 9.8.9.6.4.3.564.34.12 Criticality=false AuthorityInfoAccess [ [ accessMethod: caIssuers accessLocation: URIName: [http://address.of.ca.cert/INFO.crt](http://address.of.ca.cert/INFO.crt) , accessMethod: caIssuers accessLocation: URIName: [http://another.address.of.ca.cert/INFO.crt](http://another.address.of.ca.cert/INFO.crt) ] ] #5: objectid: 9.8.34.12 criticality=false AuthorityKeyIdentifier [ KeyIdentifier [ 0000: 29 8b 7f 4a 53 c3 d6 67 29 8b 7f 4a 53 c3 d6 67 acme service auth 0010: 29 8b 7f 4a 53 c3 d6 67 29 8b entication ] ] #6: ObjectId: 9.8.34.12 Criticality=false CRLDistributionPoints [ [DistributionPoint: [URIName: [http://path.ca.crl/INFO.crl](http://path.ca.crl/INFO.crl), URIName: [http://path.to.second.ca.crl/INFO.crl](http://path.to.second.ca.crl/INFO.crl)] ]] #7: ObjectId: 9.8.34.12 Criticality=false ExtendedKeyUsages [ clientAuth 8.2.3.4.5.6.124.45.64.3.2 ] #8: ObjectId: 9.8.34.12 Criticality=false KeyUsage [ digitalSignature Key\_Encipherment ] #9: ObjectId: 9.8.34.12 Criticality=false SubjectAlternativeName [ Other-Name: Urecognized ObjectIdentifier: 4.2.3.4.5.6.255.63.5.6 ] #10: objectid: 9.8.34.12 criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 29 8b 7f 4a 53 c3 d6 67 29 8b 7f 4a 53 c3 d6 67 some\_map 0010: 29 8b 7f 4a 53 c3 d6 67 29 8b some\_map ] ] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* I currently can't provide my full shield configuration for company security reasons. I'll probably provide parts of it later on. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [October 23, 2015, 12:10pm UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/6 "2015-10-23T12:10:59Z")
Hi @blackBagel, Would you be able to also provide the output from the elasticsearch nodes keystore/truststore? One thing I noticed is that you do not have the issuing cert in your keystore, which can be necessary to build the proper certificate chain to be sent by the transport client. ---
**Author:** ![blackBagel](https://avatars.discourse-cdn.com/v4/letter/b/f07891/32.png) [@blackBagel](https://discuss.elastic.co/u/blackBagel)\ **Post date:** [November 16, 2015, 7:47am UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/7 "2015-11-16T07:47:16Z")
Thank you so much for everything! I was finally able to solve the problem, after i found out the guy who set things up before me, actually signed the certificates with an inter ca! After that all i had to do was add the inter ca PEM file to the keystore, and set the "cacert" path to it. Sorry about the long delay... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/logstash-certificate-not-trusted/32701/8 "2017-07-06T13:47:46Z")