# Logstash issues with certificate **URL:** \ **Category:** Logstash\ **Created:** [December 7, 2021, 1:41pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124 "2021-12-07T13:41:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dominbdg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dominbdg/32/102457_2.png) [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Post date:** [December 7, 2021, 1:41pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124/1 "2021-12-07T13:41:06Z")
Hello, From a couple of days I'm fighting with certificates for logstash. Certificate was generated for logstash and filebeat clients but after couple of minutes I'm receiving below errors: in attach I don't know if this is error with my logstash certificate or certificate by clients with filebeat. ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/8/9/890586155594252c2306a6fc7967882d0e475ef7.jpeg) ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [December 8, 2021, 11:24am UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124/2 "2021-12-08T11:24:46Z")
What are params in your SSL section? Do you have permission on cert files? ---
**Author:** ![preetish\_P](https://avatars.discourse-cdn.com/v4/letter/p/77aa72/32.png) [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Post date:** [December 8, 2021, 1:33pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124/3 "2021-12-08T13:33:50Z")
1. What is the value of below settings in your Elasticsearch.yml: ```auto xpack.security.transport.ssl.verification_mode: xpack.security.http.ssl.verification_mode: ``` 1. What method have you used to create client certs for logstash and filebeat: Elasticsearch-certutil or openssl 2. Have you signed them with an intermediate / root ? ---
**Author:** ![dominbdg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dominbdg/32/102457_2.png) [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Post date:** [December 8, 2021, 5:43pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124/4 "2021-12-08T17:43:42Z")
Hello, thanks for reply. Regarding certificates - first of all I'm not shure if this is certificate for logstash or certificate for filebeat clients. In my environment I'm using logstash with certificates and filebeat using certs to authenticate with logstash. Regarding certificates I have below configuration (in attach) Regarding Elasticsearch, I don't see such configuration, I have only: xpack.security.enabled=true xpack.security.authc.realms.native.native1.order=0 Please tell me how should look like. Regarding certs, in logstash, I was using our certificate manager in AWS, but I had errors that logstash could have issues with key, so I red that key should be with pkcs8, so I used: openssl pkcs8 -topk8 -inform pem -in key.key -outform pem -nocrypt -out key1.key but with certificate I didn't do anything ![Capture1](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74180ed3b3ebcdf615f6ee19adf786cf194453fe.jpeg) regarding SSL - I'm receiving such log warnings: `Handling exception: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE` ---
**Author:** ![preetish\_P](https://avatars.discourse-cdn.com/v4/letter/p/77aa72/32.png) [@preetish\_P](https://discuss.elastic.co/u/preetish_P)\ **Post date:** [December 9, 2021, 12:11pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124/5 "2021-12-09T12:11:10Z")
My bad ! I thought both filebeats and logstash are connecting to Elasticsearch. So in your case filebeats is trying to connect to logstash over SSL and the log you have shared is of logstash I assume ? what are the ssl settings in your beats input section? esp the `ssl_verify_mode` ? If you have set this value anything other than `none` then the certs used by filebeat has to be signed by the CA mentioned within: `ssl_certificate_authorities` In that case, also verify that the certs created for filebeat has proper `Subject Alternative Names`. i.e. they are matching with filebeat server's hostname. Lastly check the `verification_mode` parameter within filebeat.yml against the `output.logstash` section. If this is full or strict then certs created for logstash must have proper `Subject Alternative Names`. i.e. they must match with logstash server's hostname. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 6, 2022, 12:11pm UTC](https://discuss.elastic.co/t/logstash-issues-with-certificate/291124/6 "2022-01-06T12:11:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.