# Metricbeat showing "server's certificate chain verification is disabled" **URL:** https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759 **Category:** Beats **Tags:** docker, metricbeat **Created:** [October 27, 2021, 7:19am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759 "2021-10-27T07:19:25Z") **Posts on this page:** 11 **Page:** 1
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [October 27, 2021, 7:19am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/1 "2021-10-27T07:19:25Z")
Hello, As far as I can see, I've set up Metricbeat to correctly validate/use SSL, but it still gives the following warning when running 'metricbeat test output': `server's certificate chain verification is disabled` My configuration for metricbeat looks like this: ```auto metricbeat.config: modules: path: ${path.config}/modules.d/*.yml # Reload module configs as they change: reload.enabled: false metricbeat.autodiscover: providers: - type: docker hints.enabled: true metricbeat.modules: - module: docker metricsets: - "container" - "cpu" - "diskio" - "healthcheck" - "info" - "memory" - "network" hosts: ["unix:///var/run/docker.sock"] period: 10s enabled: true processors: - add_cloud_metadata: ~ output.elasticsearch: hosts: '${ELASTICSEARCH_HOSTS:}' username: '${ELASTICSEARCH_USERNAME:}' password: '${ELASTICSEARCH_PASSWORD:}' ssl: enabled: true verification_mode: "full" supported_protocols: ["TLSv1.2", "TLSv1.3"] certificate_authorities: ["/etc/certificates/ca.crt"] certificate: "/etc/certificates/component.crt" key: "/etc/certificates/component.key" ``` The connection is fully working, as I can see no error from the logs of metricbeat itself and I can also see metrics showing up in Elasticsearch. I've looked through all possible SSL options to configure, but none of them seem to cover this. Does anyone have any idea here? ---
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [November 8, 2021, 9:08pm UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/2 "2021-11-08T21:08:54Z")
A bit of help here would be appreciated. I wonder if the warning is correct at all to be honest. ---
### Author: ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek) #### Post date: [November 9, 2021, 9:40am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/3 "2021-11-09T09:40:53Z")
Could you try to connect to the Elasticsearch instance using `openssl` client? What's behind the var `ELASTICSEARCH_HOSTS`? Is it an IP address or DNS name? ---
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [November 9, 2021, 10:32am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/4 "2021-11-09T10:32:51Z")
Hello Marcin, thanks for replying! The contents of `ELASTICSEARCH_HOSTS` is: ```auto ["https://01-elasticsearch-dev.internal:9200","https://02-elasticsearch-dev.internal:9200","https://03-elasticsearch-dev.internal:9200"] ``` And using `openssl s_client -CAfile ./config/certificates/ca.crt -showcerts -connect 01-elasticsearch-dev.internal:9200` I get the following: ```auto CONNECTED(00000003) depth=1 C = NL, O = Forion, CN = dev Forion CA verify return:1 depth=0 C = NL, O = Forion, CN = 01-elasticsearch-dev.internal verify return:1 --- --- Server certificate subject=/C=NL/O=Forion/CN=01-elasticsearch-dev.internal issuer=/C=NL/O=Forion/CN=dev Forion CA --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 6544 bytes and written 415 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384 Server public key is 4096 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-GCM-SHA384 Start Time: 1636453514 Timeout : 300 (sec) Verify return code: 0 (ok) --- ``` All looks good as far as I can see. ---
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [November 22, 2021, 9:44am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/5 "2021-11-22T09:44:16Z")
@mtojek or anyone else, any idea? ---
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [December 6, 2021, 8:24am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/6 "2021-12-06T08:24:20Z")
Anyone any idea already? 🙂 ---
### Author: ![fgjensen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fgjensen/32/62320_2.png) [@fgjensen](https://discuss.elastic.co/u/fgjensen) #### Post date: [December 6, 2021, 4:24pm UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/7 "2021-12-06T16:24:25Z")
I have exactly the same warning from all beat types when testning the connection to Logstash. The warning started when upgrading the beats to version 7.15.0 using TLS version 1.2. This is pretty annoying since we have service providers to deploy our beats packages on the host. We deliver the packages with Chocotey or apt. Any help would be appreiciated. BR Flemming ---
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [December 20, 2021, 6:48pm UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/8 "2021-12-20T18:48:30Z")
Anyone up for the challenge? 🙂 ---
### Author: ![Mattias\_Brunnert](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattias_brunnert/32/98686_2.png) [@Mattias\_Brunnert](https://discuss.elastic.co/u/Mattias_Brunnert) #### Post date: [January 10, 2022, 3:40am UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/9 "2022-01-10T03:40:09Z")
Hi, try setting verification\_mode to strict, it should remove the warning. [Configure SSL | Metricbeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html#client-verification-mode) ---
### Author: ![gboer](https://avatars.discourse-cdn.com/v4/letter/g/ee7513/32.png) [@gboer](https://discuss.elastic.co/u/gboer) #### Post date: [January 10, 2022, 1:38pm UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/10 "2022-01-10T13:38:14Z")
Wow, thanks @Mattias_Brunnert . That indeed solved the issue. Man, I really thought 'full' is the maximum security setting you could select. But apparently 'strict' is more 'full' 🙂 Glad to get it resolved 🙂 ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [February 7, 2022, 3:38pm UTC](https://discuss.elastic.co/t/metricbeat-showing-servers-certificate-chain-verification-is-disabled/287759/11 "2022-02-07T15:38:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.