# Secure Syslog with logstash

**URL:** <https://discuss.elastic.co/t/secure-syslog-with-logstash/159604>\
**Category:** Logstash\
**Created:** [December 5, 2018, 8:53pm UTC](https://discuss.elastic.co/t/secure-syslog-with-logstash/159604 "2018-12-05T20:53:56Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![totuyim](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@totuyim](https://discuss.elastic.co/u/totuyim)\
**Post date:** [December 5, 2018, 8:53pm UTC](https://discuss.elastic.co/t/secure-syslog-with-logstash/159604/1 "2018-12-05T20:53:56Z")

</div>

I'm using tcp input plugin, on windows, to handle SSL for receiving secure syslog but I only have the .cer file for a certification. How can I use this .cer file?

It's a client/server certificate issued by COMODO.

---

<div class="post-metadata">

**Author:** ![staodd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/staodd/32/24509_2.png) [@staodd](https://discuss.elastic.co/u/staodd)\
**Post date:** [December 6, 2018, 10:11pm UTC](https://discuss.elastic.co/t/secure-syslog-with-logstash/159604/2 "2018-12-06T22:11:05Z")

</div>

Have you read any of the documentation? What have you tried do far?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [December 10, 2018, 4:55am UTC](https://discuss.elastic.co/t/secure-syslog-with-logstash/159604/3 "2018-12-10T04:55:50Z")

</div>

> [@totuyim](#):
>
> only have the .cer file for a certification

`.cer` is a bit ambiguous .There are a number of different certificate formats which might be named ".cer".  
If the file plain text, or binary?  
What do the first and last lines look like?

Assuming that your file is _only_ a certificate and doesn't contain a key (which seems likely) then what you want is impossible. You cannot listen over SSL without a key.

---

<div class="post-metadata">

**Author:** ![totuyim](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@totuyim](https://discuss.elastic.co/u/totuyim)\
**Post date:** [December 11, 2018, 5:58pm UTC](https://discuss.elastic.co/t/secure-syslog-with-logstash/159604/4 "2018-12-11T17:58:13Z")

</div>

I see. Thank you @TimV and @staodd. I'll take a different approach.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 8, 2019, 5:58pm UTC](https://discuss.elastic.co/t/secure-syslog-with-logstash/159604/5 "2019-01-08T17:58:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.