# Problem metricbeat with ssl
**URL:** https://discuss.elastic.co/t/problem-metricbeat-with-ssl/258118
**Category:** Beats
**Tags:** elastic-stack-security, metricbeat
**Created:** [December 9, 2020, 11:44am UTC](https://discuss.elastic.co/t/problem-metricbeat-with-ssl/258118 "2020-12-09T11:44:20Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@arp220](https://discuss.elastic.co/u/arp220)
#### Post date: [December 9, 2020, 11:44am UTC](https://discuss.elastic.co/t/problem-metricbeat-with-ssl/258118/1 "2020-12-09T11:44:20Z")
Hi. I enable ssl for elasticsearch, elasticsearch config is :
```auto
cluster.name: es-cluster
path.data: /es-data/elasticsearch
path.logs: /var/log/elasticsearch
http.host: 0.0.0.0
network.host: 0
cluster.initial_master_nodes: 127.0.0.1
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: "http.p12"
```
and I enable elaticsearch-xpack module for metircbeat and config:
```auto
- module: elasticsearch
xpack.enabled: true
period: 10s
hosts: ["https://Es-ip:9200"]
username: "user"
password: "pass"
ssl.certificateAuthorities: ["/etc/metricbeat/elasticsearch-ca.pem"]
```
But I have this error:
```auto
Dec 09 15:07:39 Es metricbeat[5372]: 2020-12-09T15:07:39.020+0330 INFO module/wrapper.go:259 Error fetching data for metricset elasticsearch.cluster_stats: error determining if connected Elasticsearch node is master: error making http request: Get "https://Es-ip:9200/_nodes/_local/nodes": x509: cannot validate certificate for Es-ip because it doesn't contain any IP SANs
Dec 09 15:07:39 Es metricbeat[5372]: 2020-12-09T15:07:39.021+0330 INFO module/wrapper.go:259 Error fetching data for metricset elasticsearch.index: error determining if connected Elasticsearch node is master: error making http request: Get "https://Es-ip:9200/_nodes/_local/nodes": x509: cannot validate certificate for Es-ip because it doesn't contain any IP SANs
Dec 09 15:07:39 Es metricbeat[5372]: 2020-12-09T15:07:39.021+0330 INFO module/wrapper.go:259 Error fetching data for metricset elasticsearch.enrich: error determining if connected Elasticsearch node is master: error making http request: Get "https://Es-ip:9200/_nodes/_local/nodes": x509: cannot validate certificate for Es-ip because it doesn't contain any IP SANs
Dec 09 15:07:39 Es metricbeat[5372]: 2020-12-09T15:07:39.024+0330 INFO module/wrapper.go:259 Error fetching data for metricset elasticsearch.node_stats: error making http request: Get "https://Es-ip:9200/_nodes/_local/stats": x509: cannot validate certificate for Es-ip because it doesn't contain any IP SANs
```
Where did I go wrong?
thanks.
---
### Author:  [@mgevans](https://discuss.elastic.co/u/mgevans)
#### Post date: [December 9, 2020, 7:02pm UTC](https://discuss.elastic.co/t/problem-metricbeat-with-ssl/258118/2 "2020-12-09T19:02:37Z")
> [@arp220](#):
>
> ` because it doesn't contain any IP SANs`
Hi there - a SAN on a certificate is a Subject Alternate Name. In this case an IP SAN would probably indicate that the cert validation routine was looking to confirm the IP addr of the target of the certificate.
You'll likely need to update your certificate. Check out this article which explains a similar setup issue with someone doing logstash with a locally created certificate.
[https://serverfault.com/questions/611120/failed-tls-handshake-does-not-contain-any-ip-sans](https://serverfault.com/questions/611120/failed-tls-handshake-does-not-contain-any-ip-sans)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2021, 9:02pm UTC](https://discuss.elastic.co/t/problem-metricbeat-with-ssl/258118/3 "2021-01-06T21:02:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.