# PKI between Logstash and Winlogbeat **URL:** \ **Category:** Logstash\ **Created:** [July 27, 2017, 6:51pm UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851 "2017-07-27T18:51:05Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![socdev](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@socdev](https://discuss.elastic.co/u/socdev)\ **Post date:** [July 27, 2017, 6:51pm UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851/1 "2017-07-27T18:51:05Z")
I am having a frustrating problem with setting up PKI between Logstash and Winlogbeat. I have tried two (X-Pack, EASY-RSA) methods both successfully creating a CA, Private and Public Key, however both result in the same error message: [https://image.prntscr.com/image/2cQsMxx-SuCnTr-CHhD7Aw.png](https://image.prntscr.com/image/2cQsMxx-SuCnTr-CHhD7Aw.png) Here is what I have done: ############################# METHOD 1 ############################# Connect to Elasticsearch node01 /usr/share/elasticsearch/bin/elasticsearch-plugin install x-pack /usr/share/elasticsearch/bin/x-pack/certgen logstash1 logstash1 192.168.20.18 logstash1.jedi.local DC1 DC1 192.168.20.52 DC1.jedi.local cp /etc/elasticsearch/x-pack/certificate-bundle.zip /home/user/ chown user /home/user/certificate-bundle.zip #SCP/Copy file to Logstash1 and Winlogbeat (Just ignore the security implications with copying everything for now) rm /home/user/certificate-bundle.zip #Download and Upload to Logstash1 and DC1 cd /home/user mkdir -p /etc/logstash/ssl chown root:root /home/user/\* mv /home/user/\* /etc/logstash/ssl ls /etc/logstash/ssl ca.crt ca.key logstash1.crt logstash1.key nano /etc/logstash/conf.d/inputConfig.conf (Showing relevant part of log) # Winlogbeat / Filebeat beats { port =\> 5044 type =\> "%{[@metadata][beat]}" ssl =\> true ssl\_certificate\_authorities =\> ["/etc/logstash/ssl/ca.crt"] ssl\_certificate =\> "/etc/logstash/ssl/Logstash1.crt" ssl\_key =\> "/etc/logstash/ssl/Logstash1.key" ssl\_verify\_mode =\> "force\_peer" } service logstash restart #Download and Upload to DC1 #Copy to certs to correct directory dir C:\Winlogbeat\ssl ca.crt DC1.crt DC1.key Edit (Showing relevant part of log) C:\Winlogbeat # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate\_authorities: ["C:/Winlogbeat/ssl/ca.crt"] # Certificate for SSL client authentication ssl.certificate: "C:/Winlogbeat/ssl/DC1.crt" # Client Certificate Key ssl.key: "C:/Winlogbeat/ssl/DC1.key" winlogbeat -c winlogbeat.yml -e -v Both Winlogbeat and Logstash start fine, Logstash reports certificate error. #################################################################### ############################# METHOD 2 ############################# # Traditional EASY-RSA Method, the most ideal method. Revoking and adding certs etc... - Client and Server must have the same time, use ntp server side - ca.crt = Server Certificate - user1.crt = User Certificate - user1.key = User Key - ca.crt - This is the CA certificate - index.txt - This is the "master database" of all issued certs - serial - Stores the next serial number (serial numbers increment) - private/ca.key - This is the CA private key (security-critical) - certs\_by\_serial/ - dir with all CA-signed certs by serial number - issued/ - dir with issued certs by commonName cd /etc/logstash/ git clone [https://github.com/OpenVPN/easy-rsa.git](https://github.com/OpenVPN/easy-rsa.git) mv /etc/logstash/easy-rsa/easyrsa3 /etc/logstash/ rm -r /etc/logstash/easy-rsa cd /etc/logstash/easyrsa3 chmod +x easyrsa cp vars.example vars echo '' \>\> /etc/logstash/easyrsa3/vars echo '#Custom Variables' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA "$PWD"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_OPENSSL "openssl"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_PKI "$EASYRSA/pki"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_DN "cn\_only"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_COUNTRY "GB"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_PROVINCE "England"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_CITY "London"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_ORG "Certificate Authority"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_EMAIL "hello@acme.com"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_OU "SOC"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_KEY\_SIZE 4096' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_CA\_EXPIRE 9999' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_CERT\_EXPIRE 9999' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_REQ\_CN "SOC"' \>\> /etc/logstash/easyrsa3/vars echo 'set\_var EASYRSA\_DIGEST "sha512"' \>\> /etc/logstash/easyrsa3/vars #Generate CA ./easyrsa init-pki ./easyrsa build-ca \*\*ENTER SECURE PASSWORD - New certifcate signing requires this password \*\*CN = ca # Generate Server Cert ./easyrsa gen-req server nopass ./easyrsa sign-req server server # Unknown but do it ./easyrsa gen-dh # Generate Client Cert ./easyrsa gen-req DC1 nopass ./easyrsa sign-req client DC1 #Certificate is to be certified until Dec 7 21:30:31 2044 GMT (9999 days) - Yeah, 9999, just ignore that for now cp /etc/logstash/easyrsa3/pki/ca.crt /etc/logstash/ssl/ cp /etc/logstash/easyrsa3/pki/private/server.key /etc/logstash/ssl/ cp /etc/logstash/easyrsa3/pki/issued/server.crt /etc/logstash/ssl/ nano /etc/logstash/conf.d/inputConfig.conf # Winlogbeat / Filebeat beats { port =\> 5044 type =\> "%{[@metadata][beat]}" ssl =\> true ssl\_certificate\_authorities =\> ["/etc/logstash/ssl/ca.crt"] ssl\_certificate =\> "/etc/logstash/ssl/server.crt" ssl\_key =\> "/etc/logstash/ssl/server.key" ssl\_verify\_mode =\> "force\_peer" } cp /etc/logstash/easyrsa3/pki/ca.crt /home/user cp /etc/logstash/easyrsa3/pki/private/DC1.key /home/user cp /etc/logstash/easyrsa3/pki/issued/DC1.crt /home/user chown user /home/user/\* #COPY Files to Winglogbeat rm /home/user/_.crt rm /home/user/_.key dir C:\Winlogbeat\ssl ca.crt DC1.crt DC1.key Edit (Showing relevant part of log) C:\Winlogbeat # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate\_authorities: ["C:/Winlogbeat/ssl/ca.crt"] # Certificate for SSL client authentication ssl.certificate: "C:/Winlogbeat/ssl/DC1.crt" # Client Certificate Key ssl.key: "C:/Winlogbeat/ssl/DC1.key" ###################################################################### ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [July 28, 2017, 1:46am UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851/2 "2017-07-28T01:46:45Z")
The error message is telling you the problem, but you need to know some fairly low level details about PKI to be able to interpret it. > Looks like you either have an invalid key or your private key was not in PKCS8 format. Certgen generates keys in PKCS#1 format, but logstash requires keys in PKCS#8 format. I asusme easy-rsa does the same. That makes sense from the name, as PKCS#1 keys are _always_ RSA key, but PKCS#8 keys can use other algorithms. If you have access to openssl you can turn a PKCS#1 key into a PKCS#8 key with: ```auto openssl pkcs8 -topk8 -in logstash1.key -out logstash1-p8.key ``` ---
**Author:** ![socdev](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@socdev](https://discuss.elastic.co/u/socdev)\ **Post date:** [July 28, 2017, 8:48am UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851/3 "2017-07-28T08:48:15Z")
Hi Tim, Thanks for that but I'm still having an issue. It appears that Logstash only has a problem with the certificate not the private keys. [2017-02-23T12:24:01,573][ERROR][logstash.inputs.beats] Looks like you either have an invalid key or your private key was not in PKCS8 format. {:exception=\>java.lang.IllegalArgumentException: File does not contain valid certificates: **/etc/logstash/ssl/server.crt** } > [@socdev](#): > > ssl\_certificate\_authorities =\> ["/etc/logstash/ssl/ca\_p8.key"] > **ssl\_certificate =\> "/etc/logstash/ssl/server.crt"** > ssl\_key =\> "/etc/logstash/ssl/server\_p8.key" The ca.key and server.key were converted successfully. Appended \_p8 to name. **It looks like that command is only useful for private keys. Is there an equivalent for certificates?** ``` openssl pkcs8 -topk8 -in server.crt -out server_p8.crt unable to load key 140380844369152:error:0906D06C:PEM routines:PEM_read_bio:no start line:../crypto/pem/pem_lib.c:691:Expecting: ANY PRIVATE KEY ``` ---
**Author:** ![socdev](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@socdev](https://discuss.elastic.co/u/socdev)\ **Post date:** [August 1, 2017, 11:59am UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851/4 "2017-08-01T11:59:06Z")
Bump. Still need some help. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 29, 2017, 11:59am UTC](https://discuss.elastic.co/t/pki-between-logstash-and-winlogbeat/94851/5 "2017-08-29T11:59:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.