# Logstash is not able connect after creating certificates for elasticsearch **URL:** \ **Category:** Logstash\ **Tags:** elastic-stack-security\ **Created:** [August 9, 2019, 6:21am UTC](https://discuss.elastic.co/t/logstash-is-not-able-connect-after-creating-certificates-for-elasticsearch/194547 "2019-08-09T06:21:53Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![akshay\_singh2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akshay_singh2/32/47046_2.png) [@akshay\_singh2](https://discuss.elastic.co/u/akshay_singh2)\ **Post date:** [August 9, 2019, 6:21am UTC](https://discuss.elastic.co/t/logstash-is-not-able-connect-after-creating-certificates-for-elasticsearch/194547/1 "2019-08-09T06:21:53Z")
Hello Team, I have configured security for elasticsearch, but after it logstash is not able to connect elasticsearch. Getting below error: ``` [2019-08-08T23:13:27,353][INFO][org.apache.kafka.clients.consumer.internals.AbstractCoordinator] [Consumer clientId=logstash-0, groupId=logstash] (Re-)joining group [2019-08-08T23:13:27,379][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} [2019-08-08T23:13:27,995][INFO][org.apache.kafka.clients.consumer.internals.AbstractCoordinator] [Consumer clientId=logstash-0, groupId=logstash] Successfully joined group with generation 65 [2019-08-08T23:13:28,001][INFO][org.apache.kafka.clients.consumer.internals.ConsumerCoordinator] [Consumer clientId=logstash-0, groupId=logstash] Setting newly assigned partitions [] [2019-08-08T23:13:31,194][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_internal:xxxxxx@10.95.122.113:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://logstash_internal:xxxxxx@10.95.122.113:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} [2019-08-08T23:13:36,208][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_internal:xxxxxx@10.95.122.113:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://logstash_internal:xxxxxx@10.95.122.113:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"} ``` Logstash config file: ``` output { elasticsearch { hosts => ["https://elasticsearch_host:9200"] index => "logstash-%{+YYYY.MM.dd}" user =>"logstash_internal" password =>"some_password" ssl_certificate_verification => false } } ``` Elasticsearch.yml: ``` xpack.security.transport.ssl.verification_mode:certificate xpack.security.transport.ssl.truststore.path:certs/elastic-certificates.p12 xpack.security.transport.ssl.keystore.path:certs/elastic-certificates.p12 xpack.security.transport.ssl.enabled:true xpack.security.http.ssl.truststore.path:certs/elastic-certificates.p12 xpack.security.http.ssl.keystore.path:certs/elastic-certificates.p12 xpack.security.http.ssl.enabled:true xpack.security.http.ssl.client_authentication:optional xpack.security.enabled:true xpack.security.authc.run_as.enabled:true xpack.security.authc.realms.pki1.type:pki xpack.monitoring.history.duration:7d xpack.monitoring.collection.enabled:true node.name:${HOSTNAME} node.master:true node.data:false indices.memory.index_buffer_size:40% http.cors.enabled:true http.cors.allow-origin:* ES_JAVA_OPTS:-Xms512m -Xmx512m discovery.zen.ping.unicast.hosts:es-master discovery.zen.minimum_master_nodes:2 DISABLED_xpack.monitoring.exporters.id1.type:http DISABLED_xpack.monitoring.exporters.id1.host:http://es-monitoring.es.svc.cluster.local:9200 cluster.routing.allocation.awareness.attributes:rack_id cluster.name:rancher-es ``` Please suggest what wrong I'm doing here. Regards Akshay. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [August 9, 2019, 7:19am UTC](https://discuss.elastic.co/t/logstash-is-not-able-connect-after-creating-certificates-for-elasticsearch/194547/2 "2019-08-09T07:19:52Z")
You can export the CA certificate in PEM format from `certs/elastic-certificates.p12` with ```auto openssl pkcs12 -in certs/elastic-certificates.p12 -nokeys -cacerts -out elastic-certificates-ca.pem ``` , verify that the correct CA certificate is output with ```auto openssl x509 -in elastic-certificates-ca.pem -text -noout ``` and then use that in the Logstash's output plugin as such ```auto output { elasticsearch { hosts => ["https://elasticsearch_host:9200"] index => "logstash-%{+YYYY.MM.dd}" user =>"logstash_internal" password =>"some_password" cacert => "/the/path/on/your/system/to/elastic-certificates-ca.pem" } } See also https://www.elastic.co/guide/en/logstash/7.3/ls-security.html#ls-http-ssl ``` ---
**Author:** ![akshay\_singh2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akshay_singh2/32/47046_2.png) [@akshay\_singh2](https://discuss.elastic.co/u/akshay_singh2)\ **Post date:** [August 9, 2019, 9:39am UTC](https://discuss.elastic.co/t/logstash-is-not-able-connect-after-creating-certificates-for-elasticsearch/194547/3 "2019-08-09T09:39:51Z")
> [@ikakavas](#): > > output { elasticsearch { hosts =\> ["https://elasticsearch\_host:9200"] index =\> "logstash-%{+YYYY.MM.dd}" user =\>"logstash\_internal" password =\>"some\_password" cacert =\> "/the/path/on/your/system/to/elastic-certificates-ca.pem" } } See also [Configuring Security in Logstash | Logstash Reference [7.3] | Elastic](https://www.elastic.co/guide/en/logstash/7.3/ls-security.html#ls-http-ssl) Thanks for the quick help, it get resolved, I added false to bypass ssl\_verification: `ssl_certificate_verification => false` One more question, Is there any way to remove the user name password from conf file? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [August 9, 2019, 11:41am UTC](https://discuss.elastic.co/t/logstash-is-not-able-connect-after-creating-certificates-for-elasticsearch/194547/4 "2019-08-09T11:41:16Z")
> [@akshay\_singh2](#): > > Is there any way to remove the user name password from conf file? Yes, see [Secrets keystore for secure settings | Logstash Reference [7.3] | Elastic](https://www.elastic.co/guide/en/logstash/7.3/keystore.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 6, 2019, 11:41am UTC](https://discuss.elastic.co/t/logstash-is-not-able-connect-after-creating-certificates-for-elasticsearch/194547/5 "2019-09-06T11:41:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.