# Logstash SSL configuration invalid SecretKeyFactory not available

**URL:** <https://discuss.elastic.co/t/logstash-ssl-configuration-invalid-secretkeyfactory-not-available/280939>\
**Category:** Logstash\
**Created:** [August 10, 2021, 2:48pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-invalid-secretkeyfactory-not-available/280939 "2021-08-10T14:48:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [August 10, 2021, 2:48pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-invalid-secretkeyfactory-not-available/280939/1 "2021-08-10T14:48:40Z")

</div>

Hi folks,

I am facing following error and I am out of options to fix it:

```auto
[2021-08-10T14:43:44,743][ERROR][logstash.inputs.beats][test_pipeline] SSL configuration invalid {:exception=>Java::JavaLang::IllegalArgumentException, :message=>"File does not contain valid private key: /path/to/server.pkcs8.key", :cause=>{:exception=>Java::JavaSecurity::NoSuchAlgorithmException, :message=>"1.2.840.113549.1.5.13 SecretKeyFactory not available"}}
[2021-08-10T14:43:44,938][ERROR][logstash.javapipeline][test_pipeline] Pipeline error {:pipeline_id=>"test_pipeline", :exception=>#<LogStash::ConfigurationError: File does not contain valid private key: /path/to/server.pkcs8.key>, :backtrace=>[some backtrace]}

```

my pipeline input config:

```auto
input {
  beats {
    port => 6150
    ssl => true
    ssl_certificate_authorities => ["path/to/ca.crt"]
    ssl_certificate => "path/to/server.crt"
    ssl_key => "path/to/server.pkcs8.key"
    ssl_key_passphrase => passphrase
    ssl_verify_mode => "force_peer"
  }
}

```

I am looking forward to any hint.

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 10, 2021, 4:24pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-invalid-secretkeyfactory-not-available/280939/2 "2021-08-10T16:24:20Z")

</div>

> [@Kosodrom](#):
>
> `NoSuchAlgorithmException, :message=>"1.2.840.113549.1.5.13 SecretKeyFactory not available"`

1.2.840.113549.1.5.13 is [PBES2](https://datatracker.ietf.org/doc/html/rfc8018#appendix-A.4).

There were issues around this in Java 8, and [this](https://stackoverflow.com/questions/51242721/openssl-debugging-how-to-dump-intermediate-asn-1-inside-openssl) is an interesting tale of woe. I suspect you will have to do similar asn1parse calls to figure out what is actually in your key file.

If the key file is valid then changing security providers might fix it.

---

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [August 11, 2021, 11:02am UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-invalid-secretkeyfactory-not-available/280939/3 "2021-08-11T11:02:46Z")

</div>

Ok thanks for the hint. Before jumping into debugging private key I tried to recreate pkcs8 private key for the beats input plugin using this:

Convert a private key to PKCS#8 using a PKCS#12 compatible algorithm (3DES):

```auto
 openssl pkcs8 -in key.pem -topk8 -out enckey.pem -v1 PBE-SHA1-3DES

```

After converting the key using this 3DES algorith, my pipeline started successfuly.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2021, 11:03am UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-invalid-secretkeyfactory-not-available/280939/4 "2021-09-08T11:03:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.