# LS to ES via mTLS RSA only?

**URL:** <https://discuss.elastic.co/t/ls-to-es-via-mtls-rsa-only/374849>\
**Category:** Logstash\
**Created:** [February 21, 2025, 12:33pm UTC](https://discuss.elastic.co/t/ls-to-es-via-mtls-rsa-only/374849 "2025-02-21T12:33:04Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![natharran](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@natharran](https://discuss.elastic.co/u/natharran)\
**Post date:** [February 21, 2025, 12:33pm UTC](https://discuss.elastic.co/t/ls-to-es-via-mtls-rsa-only/374849/1 "2025-02-21T12:33:04Z")

</div>

Hello all,

I have a working configuration where Logstash authenticates to Elasticsearch via mTLS scheme using it's default RSA key. I now need to replace this key via another one that is generated by out Openshift operator. However, this operator has RSA keys forbidden and only generates ECDSA keys. If I use this key, I'm getting this error when LS starts:

```auto
exception=>#<Java::JavaSecuritySpec::InvalidKeySpecException: java.security.InvalidKeyException: Invalid RSA private key>, :backtrace=>["sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(sun/security/rsa/RSAKeyFactory.java:253)"

```

The new key is in non-encrypted PKCS8 format as was the previous one.

So Logstash only supports RSA keys?

Thanks

---

<div class="post-metadata">

**Author:** ![natharran](https://avatars.discourse-cdn.com/v4/letter/n/7feea3/32.png) [@natharran](https://discuss.elastic.co/u/natharran)\
**Post date:** [February 21, 2025, 2:38pm UTC](https://discuss.elastic.co/t/ls-to-es-via-mtls-rsa-only/374849/2 "2025-02-21T14:38:55Z")

</div>

OK the problem was that after converting the original EC key to PKCS8 the header no longed contained the "EC" keyword. So instead of BEGIN EC PRIVATE KEY only BEGIN PRIVATE KEY remained. Logstash therefore handled the key as RSA. So after key conversion I used sed:

```auto
sed -i -e 's/BEGIN PRIVATE/BEGIN EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key
sed -i -e 's/END PRIVATE/END EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key

```