### Author:  [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [August 31, 2023, 3:53pm UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072/1 "2023-08-31T15:53:10Z")
I've got an Elasticsearch instance running nicely, and I'd like to use metricbeat to monitor system performance (running on the same host).
I'm getting an x509 certificate error when I start metricbeat using `metricbeat -e`.
Here's my metricbeat config:
```auto
metricbeat:
config:
modules:
path: /etc/metricbeat/modules.d/*.yml
reload:
enabled: false
output:
elasticsearch:
hosts:
- https://localhost:9200
password: [redacted]
ssl:
ca_trusted_fingerprint: [redacted]
enabled: true
username: elastic
path:
config: /etc/metricbeat
data: /var/lib/metricbeat
home: /usr/share/metricbeat
logs: /var/log/metricbeat
processors:
- add_host_metadata: null
- add_cloud_metadata: null
- add_docker_metadata: null
- add_kubernetes_metadata: null
setup:
kibana: null
template:
settings:
index:
codec: best_compression
number_of_shards: 1
```
Here's the metricbeat log:
>
I'm confused, because the same `output:elasticsearch` section works fine for Filebeat...
I generated a self-signed cert when I set up the ES instance.
Here's my Elasticsearch config:
```auto
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["zeek1"]
http.host: 0.0.0.0
```
I know this is a common issue - I've searched to no avail!
---
### Author:  [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)
#### Post date: [September 1, 2023, 9:47am UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072/2 "2023-09-01T09:47:44Z")
Hi @artschooldropout ,
Which version of Metricbeat and Filebeat are you using? Can you try adding the `ssl_certificate_authorities` option which looks to be missing from your configuration [as per this thread](https://discuss.elastic.co/t/metricbeat-certificate-signed-by-unknow-authority/288391)?
As an FYI from version 8 onwards you may need to update your certificates to use Subject Alternative Names over CommonName:
> [@artschooldropout](#):
>
> `Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0","service.name":"metricbeat","ecs.version":"1.6.0`
---
### Author:  [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [September 1, 2023, 5:33pm UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072/3 "2023-09-01T17:33:26Z")
I'm using Metricbeat 8.9.1 and Filebeat 8.9.1. I tried adding the `ssl_certificate_authorities` option as suggested, but I get the same errors.
Here's what my metricbeat config looks like now:
```auto
output.elasticsearch:
hosts: ["https://localhost:9200"]
username: "elastic"
password: "[redacted]"
ssl:
enabled: true
ca_trusted_fingerprint: "[redacted]"
certificate_authorities: ["/etc/elasticsearch/certs/http_ca.crt"]
```
I got the cert path from the installation instructions for Debian systems: [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/deb.html)
---
### Author:  [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [September 1, 2023, 5:56pm UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072/4 "2023-09-01T17:56:49Z")
Ok, I tried changing the `/elasticsearch-xpack.yml` file to match the metricbeat config file, and the output of `metricbeat -e` seems to indicate it's up and running now. However, I'm getting a 'Monitoring Request Error' in the GUI: `[search_phase_execution_exception Root causes: no_shard_available_action_exception: null: search_phase_execution_exception Root causes: no_shard_available_action_exception: null]: all shards failed`
---
### Author:  [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)
#### Post date: [September 1, 2023, 7:52pm UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072/5 "2023-09-01T19:52:33Z")
Ok - the issue was that my instance was low on disk space. I freed up space and my Metricbeat is working nicely. Thanks @carly.richmond for your help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 29, 2023, 7:52pm UTC](https://discuss.elastic.co/t/metricbeat-x509-certificate-error/342072/6 "2023-09-29T19:52:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.