# Logstash-tcp TLS not terminating correctly

**URL:** <https://discuss.elastic.co/t/logstash-tcp-tls-not-terminating-correctly/93201>\
**Category:** Logstash\
**Created:** [July 14, 2017, 1:47pm UTC](https://discuss.elastic.co/t/logstash-tcp-tls-not-terminating-correctly/93201 "2017-07-14T13:47:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\
**Post date:** [July 14, 2017, 1:47pm UTC](https://discuss.elastic.co/t/logstash-tcp-tls-not-terminating-correctly/93201/1 "2017-07-14T13:47:55Z")

</div>

Hello, so I use two listeners on my logstash setup.

Beats and TCP (using the plugin).

Beats works fine over TLS

```
* ALPN, server did not agree to a protocol
> GET / HTTP/1.1
> Host: logstash01.xx:5044
> User-Agent: curl/7.47.0
> Accept: */*
> 
* Empty reply from server
* Connection #0 to host logstash01.xx left intact

```

However TCP fails?

```
    ubuntu@gnt1-syslog01:/etc/rsyslog.d$ curl -v --cacert /etc/ssl/certs/globalsign_xxx.crt https://logstash01.xxx:10514
    * Rebuilt URL to: https://xxx:10514/
    * Trying xxx...
    * Connected to logstash01.xxx (52.51.14.173) port 10514 (#0)
    * found 3 certificates in /etc/ssl/certs/globalsign_xxx.crt
    * found 695 certificates in /etc/ssl/certs
    * ALPN, offering http/1.1
    * gnutls_handshake() failed: The TLS connection was non-properly terminated.
    * Closing connection 0
    curl: (35) gnutls_handshake() failed: The TLS connection was non-properly terminated.

```

Here is the logstash output for both:

```
input {
  tcp {
    port => 10514
    type => "rsyslog"
    ssl_enable => true
    ssl_cert => "/etc/pki/logstash/globalsign_xxx.crt"
    ssl_key => "/etc/pki/logstash/globalsign_xxx.key"
  }
}

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/logstash/xxx.crt"
    ssl_key => "/etc/pki/logstash/xxx.key"
  }
}

```

The error I see from rsyslog is the same terminating error.

---

<div class="post-metadata">

**Author:** ![runtman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/runtman/32/18136_2.png) [@runtman](https://discuss.elastic.co/u/runtman)\
**Post date:** [July 14, 2017, 2:10pm UTC](https://discuss.elastic.co/t/logstash-tcp-tls-not-terminating-correctly/93201/2 "2017-07-14T14:10:14Z")

</div>

The fix was adding

```
ssl_verify => false

```

I'd love to understand why however?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2017, 2:10pm UTC](https://discuss.elastic.co/t/logstash-tcp-tls-not-terminating-correctly/93201/3 "2017-08-11T14:10:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.