# \[mTLS\]\[filebeat-logstash\]\[beat-input-plugin\] Client certificate hostname verification **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [September 1, 2021, 2:16am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973 "2021-09-01T02:16:36Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![LotusD](https://avatars.discourse-cdn.com/v4/letter/l/c57346/32.png) [@LotusD](https://discuss.elastic.co/u/LotusD)\ **Post date:** [September 1, 2021, 2:16am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/1 "2021-09-01T02:16:36Z")
Dear All, I'm trying to set up mTLS between filebeat (client) and logstash (server). I refer to the documents [Secure communication with Logstash | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html) Filebeat config: ```auto output.logstash: hosts: ["logs.mycompany.com:5044"] ssl.certificate_authorities: ["/etc/ca.crt"] ssl.certificate: "/etc/client.crt" ssl.key: "/etc/client.key" ``` Logstash config: ```auto input { beats { port => 5044 ssl => true ssl_certificate_authorities => ["/etc/ca.crt"] ssl_certificate => "/etc/server.crt" ssl_key => "/etc/server.key" ssl_verify_mode => "force_peer" } } ``` After setup and test, I observed if I installed a wrong client certificate (Common Name's different with Client Hostname i.e. Common Name: [xxxxfilebeat.abc.com](http://xxxxfilebeat.abc.com) while Client Hostname:filebeat.abc.com) but signed by trusted CA, mTLS connection can successfully be set up. It seems that server's not verify client certificate hostname. Could you please kindly hint me how to set _beat input plugin_ if server is requested to verify client certificate hostname? Moreover, for filebeat rather than beat input plugin, it can be configurated by verification mode set to _full_ ([Configure SSL | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#client-verification-mode)). Thank you. ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 2, 2021, 2:31am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/2 "2021-09-02T02:31:40Z")
The host name verification is only one way. The client verifies the server certificate is trusted and the SAN/common name matches the address used to connect to it. The server then verifies the client cert is trusted. It has no way of validating the hostname of the client. In some mtls scenarios where there is also a username/pass, the server will validate the client cert matches the username. ---
**Author:** ![LotusD](https://avatars.discourse-cdn.com/v4/letter/l/c57346/32.png) [@LotusD](https://discuss.elastic.co/u/LotusD)\ **Post date:** [September 2, 2021, 9:54am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/3 "2021-09-02T09:54:44Z")
Thank you so much for your reply. If filebeat (client) and logstash (server), how to set that the server validates whether the client certificate matches the username? Moreover, what steps are set when server validates client certificate? CA? Validation periods? Will server check client Signatures? Will client hostname validation's considered in future beat input plugin release? ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 2, 2021, 11:31am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/4 "2021-09-02T11:31:34Z")
> [@LotusD](#): > > how to set that the server validates whether the client certificate matches the username? There is no username/password for beats to logstash, just client cert. > [@LotusD](#): > > Moreover, what steps are set when server validates client certificate? CA? Validation periods? Will server check client Signatures? What do you mean? The CA u provide logstash is what validates if a client cert is trusted. > [@LotusD](#): > > Will client hostname validation's considered in future beat input plugin release? This is not part of the TLS spec and I don't believe it will ever be. The server has no way of knowing the hostname of the client. ---
**Author:** ![LotusD](https://avatars.discourse-cdn.com/v4/letter/l/c57346/32.png) [@LotusD](https://discuss.elastic.co/u/LotusD)\ **Post date:** [September 2, 2021, 1:43pm UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/5 "2021-09-02T13:43:30Z")
Thank you so much. > This is not part of the TLS spec and I don't believe it will ever be. The server has no way of knowing the hostname of the client. Client hostname verification's designed in filebeat. However, it's removed from _beats input plugin_. **Could you please kindly hint me the reasons?** I felt confused and that's why I ask whether there's a plan to add additional client hostname verification in the future. [Configure SSL | Filebeat Reference [7.14] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#server-verification-mode) > `verification_mode` > Controls the verification of client certificates. Valid values are: > `full` > Verifies that the provided certificate is signed by a trusted authority (CA) and also verifies that the server’s hostname (or IP address) matches the names identified within the certificate. [Beats input plugin | Logstash Reference [7.14] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html#plugins-inputs-beats-ssl_verify_mode) > `ssl_verify_mode` > 1.Value can be any of: `none` , `peer` , `force_peer` > 2.Default value is `"none"` > By default the server doesn’t do any client verification. > `peer` will make the server ask the client to provide a certificate. If the client provides a certificate, it will be validated. > `force_peer` will make the server ask the client to provide a certificate. If the client doesn’t provide a certificate, the connection will be closed. > This option needs to be used with `ssl_certificate_authorities` and a defined list of CAs. ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [September 3, 2021, 12:56pm UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/6 "2021-09-03T12:56:34Z")
The verification that logstash is talking about is validating that the client cert is signed by a trusted CA. Filebeat can do hostname verification because it's what is initiating the connection to the logstash sever so it can verify that the cert is trusted and that the SANS/CN matches the address that it's trying to connect to. > [@LotusD](#): > > Client hostname verification's designed in filebeat. I don't know what you mean here. ---
**Author:** ![LotusD](https://avatars.discourse-cdn.com/v4/letter/l/c57346/32.png) [@LotusD](https://discuss.elastic.co/u/LotusD)\ **Post date:** [September 6, 2021, 5:58am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/7 "2021-09-06T05:58:31Z")
Thank you so much for your reply^^. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 4, 2021, 7:58am UTC](https://discuss.elastic.co/t/mtls-filebeat-logstash-beat-input-plugin-client-certificate-hostname-verification/282973/8 "2021-10-04T07:58:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.