# logstash Handling exception: io.netty.handler.codec.DecoderException:
**URL:** https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054
**Category:** Logstash
**Created:** [August 31, 2023, 1:57pm UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054 "2023-08-31T13:57:39Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@zuoseven](https://discuss.elastic.co/u/zuoseven)
#### Post date: [August 31, 2023, 1:57pm UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/1 "2023-08-31T13:57:39Z")
```auto
Handling exception: io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain (caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chain)
[2023-08-31T19:03:14,618][WARN][io.netty.channel.DefaultChannelPipeline][test-event][test-event-filebeat] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:477) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:655) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:581) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989) [netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.65.Final.jar:4.1.65.Final]
at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chain
at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:347) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:303) ~[?:?]
at sun.security.ssl.TransportContext.fatal(TransportContext.java:294) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:390) ~[?:?]
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:375) ~[?:?]
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392) ~[?:?]
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1076) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1063) ~[?:?]
at java.security.AccessController.doPrivileged(Native Method) ~[?:?]
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1010) ~[?:?]
at io.netty.handler.ssl.SslHandler.runAllDelegatedTasks(SslHandler.java:1512) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1526) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1390) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1234) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1280) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:507) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:446) ~[netty-all-4.1.65.Final.jar:4.1.65.Final]
... 17 more
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 31, 2023, 5:02pm UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/2 "2023-08-31T17:02:50Z")
> Handling exception: io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Empty server certificate chain (caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chain)
If you're sending messages from FB to LS over HTTPS, the most likely you haven't set properly certificates.
FB side:
```auto
output.logstash:
hosts: ["logs.mycompany.com:5044"]
ssl.certificate_authorities: ["/etc/filebeat/ca.crt"]
ssl.certificate: "/etc/filebeat/client.crt"
ssl.key: "/etc/filebeat/client.key"
#' ssl_verify_mode => "none" # in case it's not working try without cert verifcation
```
LS side
```auto
input {
beats {
port => 5040
ssl_enabled => true
ssl_certificate => “/etc/logstash/ca.crt”
ssl_key => “/etc/logstash/logstash.key”
#' ssl_verify_mode => "none" # in case it's not working try without cert verifcation
}
}
```
---
### Author:  [@zuoseven](https://discuss.elastic.co/u/zuoseven)
#### Post date: [September 1, 2023, 3:17am UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/3 "2023-09-01T03:17:40Z")
here is my filebeat conf
```auto
ssl.certificate_authorities: ["/etc/filebeat/ca.pem"]
ssl.certificate: "/etc/filebeat/filebeat.crt"
ssl.key: "/etc/filebeat/filebeat.key"
```
hers is my logstash conf
```auto
port => "5046"
ssl => true
ssl_certificate_authorities => ["/etc/logstash/certs/ca.pem"]
ssl_certificate => "/etc/logstash/certs/logstash.crt"
ssl_key => "/etc/logstash/certs/logstash.p8"
ssl_verify_mode => "force_peer"
client_inactivity_timeout => 1800
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [September 1, 2023, 4:51am UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/4 "2023-09-01T04:51:07Z")
Empty server certificate chain - something is not OK with root or server sertificate, like not trusted.
Have you tried with `ssl_verify_mode => "none"`?
Have you checked permission on all certs?
Are certs generated by elasticsearch-certutil or are issued by other CA agency?
---
### Author:  [@zuoseven](https://discuss.elastic.co/u/zuoseven)
#### Post date: [September 1, 2023, 5:53am UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/5 "2023-09-01T05:53:43Z")
here is my create ca cmd
```auto
cd /usr/share/elasticsearch/
./bin/elasticsearch-certutil ca
openssl pkcs12 -clcerts -nokeys -in elastic-stack-ca.p12 -out ca.pem
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --name logstash --dns logstash --days 3650 --ip x.x.x.x --pem --out logstash.zip
./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 --name filebeat --dns filebeat --days 3650 --ip x.x.x.x --pem --out filebeat.zip
```
---
### Author:  [@zuoseven](https://discuss.elastic.co/u/zuoseven)
#### Post date: [September 1, 2023, 5:54am UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/6 "2023-09-01T05:54:15Z")
all permission is 644
I am not try `ssl_verify_mode => "none"`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2023, 5:54am UTC](https://discuss.elastic.co/t/logstash-handling-exception-io-netty-handler-codec-decoderexception/342054/7 "2023-09-29T05:54:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.