# Logstash + SSL

**URL:** <https://discuss.elastic.co/t/logstash-ssl/250234>\
**Category:** Logstash\
**Created:** [September 28, 2020, 4:41pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234 "2020-09-28T16:41:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![brapnda23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brapnda23/32/71267_2.png) [@brapnda23](https://discuss.elastic.co/u/brapnda23)\
**Post date:** [September 28, 2020, 4:41pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234/1 "2020-09-28T16:41:35Z")

</div>

Hey guys,  
As soon as I add below three SSL\* lines to the input section of logstash.conf, service gives me below error;

`*[2020-09-28T12:19:05,245][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}*`

```
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/logstash/certs/ca.crt"
    ssl_key => "/etc/logstash/certs/ca.key"
  }
}
output {
  elasticsearch {
    hosts => ["https://elk01:9200"]
    index => "%{[fields][environment_name]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    cacert => '/etc/logstash/certs/ca.crt'
    user => "elastic"
    password => ""
  }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 28, 2020, 8:20pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234/2 "2020-09-28T20:20:46Z")

</div>

If you enable log.level debug is there a message that says what the problem is? You may be hitting [this](https://github.com/elastic/logstash/issues/12232) issue.

---

<div class="post-metadata">

**Author:** ![brapnda23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brapnda23/32/71267_2.png) [@brapnda23](https://discuss.elastic.co/u/brapnda23)\
**Post date:** [September 29, 2020, 5:59pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234/3 "2020-09-29T17:59:23Z")

</div>

Debug logs showing the private key issue. I have tried pkcs8.key but no luck.

openssl pkcs8 -in elk01.key -topk8 -out elk01-pkcs8.key -nocrypt

```
[2020-09-29T07:28:35,918][DEBUG][logstash.javapipeline][main] Pipeline terminated by worker error {:pipeline_id=>"main", :exception=>java.lang.IllegalArgumentException: File does not contain valid private key: /etc/logstash/certs/elk01.key, 

```

:backtrace=\>"io.netty.handler.ssl.SslContextBuilder.keyManager(io/netty/handler/ssl/SslContextBuilder.java:350)",

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 29, 2020, 6:03pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234/4 "2020-09-29T18:03:28Z")

</div>

> [@brapnda23](#):
>
> `File does not contain valid private key: /etc/logstash/certs/elk01.key`

That is not elk01-pkcs8.key 😃

---

<div class="post-metadata">

**Author:** ![brapnda23](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brapnda23/32/71267_2.png) [@brapnda23](https://discuss.elastic.co/u/brapnda23)\
**Post date:** [September 29, 2020, 6:16pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234/5 "2020-09-29T18:16:15Z")

</div>

That log is before the pkcs file. Couldn't capture logs after I generated the pkcs file. It just won't generate debug logs at all. not sure why. The only thing I changed from yesterday is, password unprotected keystore to keep the passwords for logstash. I will try out in my other instance.

Is there any other way to configure beats to submit logs with authentication? Don't want anonymous injection.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2020, 6:16pm UTC](https://discuss.elastic.co/t/logstash-ssl/250234/6 "2020-10-27T18:16:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.