I renewed my Logstash PKI but when re-deploying all the client certificates to my Beats, they all encountered the following error :
`ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(async(tcp://logstash.example.com:5044)): tls: invalid signature by the server certificate: crypto/rsa: verification error`
After checking with another PKI (this one was still valid and in order), the only difference was that when renewing I had lost the Bag attributes metadata in the certificates. At first, I didn't think this could be the issue because these are supposed to be optional. But when I finally decided to give it a try by including the Bag Attributes, it worked and my Beats were able to send to Logstash. I wanted to raise this issue for anyone struggling like I did, and I hope we can get someone to clarify this. Maybe there's a reason for it but I think it should at least be mentioned in the documentation.