# Logstash PKI : Why does Logstash rely on optionnal metadata (Bag Attributes)?

**URL:** <https://discuss.elastic.co/t/logstash-pki-why-does-logstash-rely-on-optionnal-metadata-bag-attributes/384389>\
**Category:** Logstash\
**Created:** [January 6, 2026, 12:56pm UTC](https://discuss.elastic.co/t/logstash-pki-why-does-logstash-rely-on-optionnal-metadata-bag-attributes/384389 "2026-01-06T12:56:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![CitizenSteak](https://avatars.discourse-cdn.com/v4/letter/c/d07c76/32.png) [@CitizenSteak](https://discuss.elastic.co/u/CitizenSteak)\
**Post date:** [January 6, 2026, 12:56pm UTC](https://discuss.elastic.co/t/logstash-pki-why-does-logstash-rely-on-optionnal-metadata-bag-attributes/384389/1 "2026-01-06T12:56:54Z")

</div>

I renewed my Logstash PKI but when re-deploying all the client certificates to my Beats, they all encountered the following error :

`ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(async(tcp://logstash.example.com:5044)): tls: invalid signature by the server certificate: crypto/rsa: verification error`

After checking with another PKI (this one was still valid and in order), the only difference was that when renewing I had lost the Bag attributes metadata in the certificates. At first, I didn't think this could be the issue because these are supposed to be optional. But when I finally decided to give it a try by including the Bag Attributes, it worked and my Beats were able to send to Logstash. I wanted to raise this issue for anyone struggling like I did, and I hope we can get someone to clarify this. Maybe there's a reason for it but I think it should at least be mentioned in the documentation.

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [January 6, 2026, 2:03pm UTC](https://discuss.elastic.co/t/logstash-pki-why-does-logstash-rely-on-optionnal-metadata-bag-attributes/384389/2 "2026-01-06T14:03:03Z")

</div>

There are different types of certificates, for example the X.509 certificate type generated by  
OpenSSL stored in PEM-format (pem file extension) does not use BagAttributes. Then you have the PKCS formats like PKCS#12 object format (p12/ / pfx file extension) which is defined in [RFC7292](https://datatracker.ietf.org/doc/html/rfc7292) and this format uses BagAttributes. Logstash is written in Java and java uses PKCS fomat for it's certificates, see [logstash/logstash-core/src/main/java/org/logstash/secret/store/backend/JavaKeyStore.java at f9d8b771e565bfe35fc71e72ae389eaa3df26d03 · elastic/logstash · GitHub](https://github.com/elastic/logstash/blob/f9d8b771e565bfe35fc71e72ae389eaa3df26d03/logstash-core/src/main/java/org/logstash/secret/store/backend/JavaKeyStore.java#L78)

So that's why BagAttributes are required fr the PFX file.

I hope this clears up a few things. You can read more about PKI here: [Everything you should know about certificates and PKI but are too afraid to ask](https://smallstep.com/blog/everything-pki/)