LS to ES via mTLS RSA only?

Elastic Stack Logstash
1

Hello all,

I have a working configuration where Logstash authenticates to Elasticsearch via mTLS scheme using it's default RSA key. I now need to replace this key via another one that is generated by out Openshift operator. However, this operator has RSA keys forbidden and only generates ECDSA keys. If I use this key, I'm getting this error when LS starts:

exception=>#<Java::JavaSecuritySpec::InvalidKeySpecException: java.security.InvalidKeyException: Invalid RSA private key>, :backtrace=>["sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(sun/security/rsa/RSAKeyFactory.java:253)"

The new key is in non-encrypted PKCS8 format as was the previous one.

So Logstash only supports RSA keys?

Thanks

2

OK the problem was that after converting the original EC key to PKCS8 the header no longed contained the "EC" keyword. So instead of BEGIN EC PRIVATE KEY only BEGIN PRIVATE KEY remained. Logstash therefore handled the key as RSA. So after key conversion I used sed:

sed -i -e 's/BEGIN PRIVATE/BEGIN EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key
sed -i -e 's/END PRIVATE/END EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key