# Logstash does not accept SSL connections from beats

**URL:** <https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775>\
**Category:** Logstash\
**Created:** [May 3, 2025, 5:08pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775 "2025-05-03T17:08:57Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ruslan\_Hafizov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruslan_hafizov/32/139786_2.png) [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\
**Post date:** [May 3, 2025, 5:08pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/1 "2025-05-03T17:08:57Z")

</div>

I was trying to set up SSL/TLS between beats and input beats in logstash. To create the certificates, I used the following commands:

```auto
### creating logstash.p12
elasticsearch-certutil crl --ca /usr/share/elasticsearch/config/certs/elastic-stack-ca.p 12 -in /usr/share/elasticsearch/config/certs/instance.yaml
### logstash.crt
openssl pkcs12 -in logstash.p12 -clcerts -nokeys -out logstash.crt -password pass:yourpassword
### logstash.key
openssl pkcs12 -in logstash.p12 -nocerts -out logstash.key -notes -password pass:yourpassword
### logstash.pkcs8.key
openssl pkcs 8 -topk8 -in logstash.key -out logstash.pkcs 8.key -v2 aes-256-cbc -2gr hmacWithSHA256
### client.crt
openssl pkcs12 -in cert.p12 -clcerts -nokeys -out client.crt -password pass:yourpassword

```

The following settings were used as input data for generating the p12 storage:

```auto
instances:
  - name: "logstash"
    dns:
    - "logstash"
    - "logstashx"
    ip:
    - "10.01.10.10"

```

I used the following settings for input:

```auto
input {
beats {
    port => 5044
    ssl_client_authentication => "required"
    ssl_enabled => true
    ssl_certificate_authorities => ["/usr/share/logstash/config/certs/ca.crt"]
    ssl_certificate => "/usr/share/logstash/config/certs/client.crt"
    ssl_key => "/usr/share/logstash/config/certs/logstash.pkcs8.key"
    ssl_key_passphrase => "***"
  }
}

```

In output beats, I used different approaches, creating a separate p12 storage in the same way as for logstash, from which I then took out the key and certificate for beats. I also used the logstash certificate itself, but I got SSL errors. The last example of what I tried using the settings:

```auto
output.logstash:
  hosts: ["logstash:5044"]
  ssl:
    enabled: true
    certificate_authorities: ["/etc/pki/root/ca.crt"]
    ssl.certificate: "/logstash/certs/client.crt"
    ssl.key: "/logstash/certs/logstash.pkcs8.key"
    ssl_key_passphrase: "***"

```

I get the following error :

```auto
[2025-05-02T19:02:02,741][WARN][io.netty.channel.DefaultChannelPipeline][main][5036d1d5e0ca7bd9c07af2050b1d7965127518bd086130be02b9f8fd80ece896] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) ~[netty-codec-4.1.109.Final.jar:4.1.109.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290) ~[netty-codec-4.1.109.Final.jar:4.1.109.Final]

```

Tell me what I'm doing wrong. Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 4, 2025, 6:58am UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/2 "2025-05-04T06:58:43Z")

</div>

Hi @Ruslan_Hafizov Welcome to the community.

> [@Ruslan\_Hafizov](#):
>
> `pkcs8.key`

Edited Corrected!! @Rios is correct! 😀 You need the pks8 format on the logstash beats input side

> **[Beats input plugin | Elastic Documentation](https://www.elastic.co/docs/reference/logstash/plugins/plugins-inputs-beats#plugins-inputs-beats-ssl_key)**
>
> Plugin version: v7.0.0, Released on: 2024-12-02, Changelog. For other versions, see the Versioned plugin docs. For questions about the plugin, open a...

But not on the [beats output side](https://www.elastic.co/docs/reference/beats/filebeat/configuring-ssl-logstash)

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 4, 2025, 10:21am UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/3 "2025-05-04T10:21:54Z")

</div>

Only input beats in LS need ssl\_key in [the PKCS8 format](https://www.elastic.co/docs/reference/logstash/plugins/plugins-inputs-beats#plugins-inputs-beats-ssl_key). It's also on [github](https://github.com/logstash-plugins/logstash-input-beats/blob/74c9bac6737b02beaab3470b3d4b7485878733fb/lib/logstash/inputs/beats.rb#L82C1-L83C1). Other use the PEM format, LS output and [FB output](https://www.elastic.co/docs/reference/beats/filebeat/configuration-ssl).

---

<div class="post-metadata">

**Author:** ![Ruslan\_Hafizov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruslan_hafizov/32/139786_2.png) [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\
**Post date:** [May 4, 2025, 5:25pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/4 "2025-05-04T17:25:29Z")

</div>

Thank you all for your answers. This is actually my mistake, but I've also tried this option before. In this case, I was getting a different error :

```auto
[2025-05-04T17:17:02,007][WARN][io.netty.channel.DefaultChannelPipeline][main][b69a2eb3cac144215f5159fc01021d41845460d18e73f609de0fb868bbf430b5] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty client certificate chain
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:500) ~[netty-codec-4.1.109.Final.jar:4.1.109.Final]

```

I also used other commands to generate certificates.

```auto
openssl genrsa -out beats.key 2048

openssl req -new -key beats.key -out beats.csr -subj "/CN=beats-client"

create beats.ext:

---
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation
extendedKeyUsage = clientAuth
---

openssl x509 -req -in beats.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out beats.crt -days 365 -sha256 -extfile beats.ext

#ca.crt and ca.key were extracted from elasticsearch-stack-ca.p12

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 4, 2025, 7:41pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/5 "2025-05-04T19:41:50Z")

</div>

You should use the elastic cert util and only use the openssl tool as directed to make the pks8 key.

Here are the comands I ran

```auto
$ ./bin/elasticsearch-certutil ca --pem

$ unzip elastic-stack-ca.zip

$ ./bin/elasticsearch-certutil cert --name logstash --ca-cert ./ca/ca.crt --ca-key ./ca/ca.key --dns ip-10-0-0-7 --ip 10.0.0.7 --pem

$ unzip certificate-bundle.zip

$ openssl pkcs8 -inform PEM -in ./logstash/logstash.key -topk8 -nocrypt -outform PEM -out ./logstash/logstash.pkcs8.key

$ ls logstash/
logstash.crt logstash.key logstash.pkcs8.key

$ sudo -i 

# cd /etc/logstash/
# mkdir certs
# cp /home/ubuntu/elasticsearch-8.11.1/logstash/* certs/.
# chmod 664 certs/logstash.pkcs8.key
# cp /home/ubuntu/elasticsearch-8.11.1/ca/ca.crt certs/.

```

---

<div class="post-metadata">

**Author:** ![Ruslan\_Hafizov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruslan_hafizov/32/139786_2.png) [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\
**Post date:** [May 5, 2025, 7:58am UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/6 "2025-05-05T07:58:50Z")

</div>

> [@stephenb](#):
>
> `openssl pkcs8 -inform PEM -in ./logstash/logstash.key -topk8 -nocrypt -outform PEM -out ./logstash/logstash.pkcs8.key`

I tried to do what was mentioned above. It didn't help, the error remained the same:

```auto
[2025-05-05T07:44:01,838][WARN][io.netty.channel.DefaultChannelPipeline][main][e22721fd705d0d15e154244309c305d07a4b9acdc0df80c0c3baac2539120e57] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty client certificate chain

```

After that, I re-created the certificates for beats with the following command:

```auto
elasticsearch-certutil cert --name beat --ca-cert /usr/share/elasticsearch/config/certs/ca.crt --ca-key /usr/share/elasticsearch/config/certs/ca.key --dns logstash --ip 10.10.10.10 --pem 

```

Accordingly, I made changes to the configuration and restarted the service.

```auto
output.logstash:

  hosts: ["logstash:5044"]
  ssl:
    enabled: true # I also removed and returned this option.
    certificate_authorities: ["/etc/pki/root/ca.crt"]
    ssl.certificate: "/etc/pki/beats/beat.crt"
    ssl.key: "/etc/pki/beats/beat.key"

```

But the problem remains

---

<div class="post-metadata">

**Author:** ![grumo35](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/grumo35/32/59451_2.png) [@grumo35](https://discuss.elastic.co/u/grumo35)\
**Post date:** [May 5, 2025, 10:54am UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/7 "2025-05-05T10:54:47Z")

</div>

Hey !

Same error message ?

Can we try to debug the SSL part with openssl s\_client ?

```auto
openssl s_client -connect logstash:5044 -CAfile </path/ca.crt> -cert </path/client.crt> -key </path/client.key>

```

Please share the output, be aware of potential sensitive information before sharing 😉

---

<div class="post-metadata">

**Author:** ![khan1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/khan1/32/142869_2.png) [@khan1](https://discuss.elastic.co/u/khan1)\
**Post date:** [May 5, 2025, 11:26am UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/8 "2025-05-05T11:26:51Z")

</div>

I'm trying to set up SSL/TLS between Beats and Logstash using certificates I generated with elasticsearch-certutil and openssl. The Logstash input config expects client authentication, and I provided the necessary certs and keys, including `logstash.pkcs8.key` and `client.crt`.

My Logstash input config looks like this:

ruby

CopyEdit

```auto
input {
  beats {
    port => 5044
    ssl_enabled => true
    ssl_client_authentication => "required"
    ssl_certificate_authorities => ["/usr/share/logstash/config/certs/ca.crt"]
    ssl_certificate => "/usr/share/logstash/config/certs/client.crt"
    ssl_key => "/usr/share/logstash/config/certs/logstash.pkcs8.key"
    ssl_key_passphrase => 
  }
}

```

My Beats output config:

yaml

CopyEdit

```auto
output.logstash:
  hosts: ["logstash:5044"]
  ssl:
    enabled: true
    certificate_authorities: ["/etc/pki/root/ca.crt"]
    certificate: "/logstash/certs/client.crt"
    key: "/logstash/certs/logstash.pkcs8.key"
    key_passphrase: 

```

But I keep getting this error:

makefile

CopyEdit  
SSLHandshakeException: Received fatal alert: bad\_certificate

What's likely wrong?

This error usually means:

The certificate sent by Beats is either not valid, not trusted by Logstash, or  
It doesn't match the private key, or  
The CA that issued the cert is missing or wrong in `ssl_certificate_authorities`.

Suggestions:

1. Use a separate certificate for Beats:  
Logstash and Beats should each have their own client certificate signed by the same CA. Don't reuse `logstash.pkcs8.key` for Beats.
2. Check the CA:  
Make sure the `ca.crt` used by both Logstash and Beats is the same one that issued the client certs.
3. Verify matching cert/key pair:  
Use this to check:

bash

CopyEdit

```auto
openssl x509 -noout -modulus -in client.crt | openssl md5
openssl rsa -noout -modulus -in client.key | openssl md5

```

They should output the same hash.  
4. Set correct permissions on all cert/key files and avoid formatting issues (e.g., no spaces in filenames like `pkcs 8.key` → rename it to `pkcs8.key`).

---

<div class="post-metadata">

**Author:** ![Ruslan\_Hafizov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruslan_hafizov/32/139786_2.png) [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\
**Post date:** [May 5, 2025, 3:03pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/9 "2025-05-05T15:03:01Z")

</div>

I get the following:

```auto
CONNECTED(00000003)
Can't use SSL_get_servername
depth=1 CN = Elastic Certificate Tool Autogenerated CA
verify return:1
depth=0 CN = logstash
verify return:1
---
Certificate chain
 0 s:CN = logstash
   i:CN = Elastic Certificate Tool Autogenerated CA
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: May 4 15:48:43 2025 GMT; NotAfter: May 4 15:48:43 2026 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
subject=CN = logstash
issuer=CN = Elastic Certificate Tool Autogenerated CA
---
Acceptable client certificate CA names
CN = Elastic Certificate Tool Autogenerated CA
Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512:ECDSA+SHA1:RSA+SHA1
Shared Requested Signature Algorithms: ECDSA+SHA256:ECDSA+SHA384:ECDSA+SHA512:Ed25519:Ed448:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA-PSS+SHA256:RSA-PSS+SHA384:RSA-PSS+SHA512:RSA+SHA256:RSA+SHA384:RSA+SHA512
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1538 bytes and written 2386 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol : TLSv1.3
    Cipher : TLS_AES_256_GCM_SHA384
    Session-ID: 2C2063CB9ED35777058C653424221F3948BECAAFBB30B91B1532355D67A9411D
    Session-ID-ctx:
    Resumption PSK: 344F9F1A8296C9FDF2A7A30606020ABF4FD4DE50BD273F5107A5E017DD08F1E366C0A070059446A68DBF7FA22A2DCA60
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 86400 (seconds)
    TLS session ticket:
...

    Start Time: 1746456779
    Timeout : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK

```

---

<div class="post-metadata">

**Author:** ![Ruslan\_Hafizov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruslan_hafizov/32/139786_2.png) [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\
**Post date:** [May 5, 2025, 3:28pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/10 "2025-05-05T15:28:13Z")

</div>

1. This is one of the options I've been checking.
2. - 4. I checked, everything is fine

```auto
openssl verify -CAfile ca.crt ../beats/beat.crt
../beats/beat.crt: OK

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 5, 2025, 5:20pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/11 "2025-05-05T17:20:05Z")

</div>

> [@khan1](#):
>
> ```auto
> output.logstash:
> hosts: ["logstash:5044"]
> ssl:
> enabled: true
> certificate_authorities: ["/etc/pki/root/ca.crt"]
> certificate: "/logstash/certs/client.crt"
> key: "/logstash/certs/logstash.pkcs8.key". 
> ^^^^^ THIS IS NOT CORRECT USE NORMAL NON PKCS8.KEY
> key_passphrase: 
> 
> ```

That should be the normal key on the beats side, yeah confusing as @Rios noted above

As shown [here](https://www.elastic.co/docs/reference/beats/filebeat/configuring-ssl-logstash)

In my example above that would be

```auto
output.logstash:
  hosts: ["logstash:5044"]
  ssl:
    enabled: true
    certificate_authorities: ["/etc/pki/root/ca.crt"]
    certificate: "/logstash/certs/client.crt"
    key: "/logstash/certs/logstash.key"

```

AND I would do all this testing First without pass phrases etc first then add once you get working... the command I gave above work

---

<div class="post-metadata">

**Author:** ![Ruslan\_Hafizov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruslan_hafizov/32/139786_2.png) [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\
**Post date:** [May 7, 2025, 1:12pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775/12 "2025-05-07T13:12:04Z")

</div>

I thank the participants for their answers. My problem was on the output for beats side. I used an extra ssl prefix.