# Setting up Secure connection between Filebeat and Logstash

**URL:** <https://discuss.elastic.co/t/setting-up-secure-connection-between-filebeat-and-logstash/189959>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [July 11, 2019, 9:48am UTC](https://discuss.elastic.co/t/setting-up-secure-connection-between-filebeat-and-logstash/189959 "2019-07-11T09:48:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Altiano\_Gerung](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/altiano_gerung/32/38040_2.png) [@Altiano\_Gerung](https://discuss.elastic.co/u/Altiano_Gerung)\
**Post date:** [July 11, 2019, 9:48am UTC](https://discuss.elastic.co/t/setting-up-secure-connection-between-filebeat-and-logstash/189959/1 "2019-07-11T09:48:27Z")

</div>

Elastic stack version: 7.2.0

I want to setup a secure connection.

First, I generated the certificates with:  
`bin/elasticsearch-certutil`

Got : `ca.crt`, `instance.crt`, `instance.key`

Then set `filebeat.yml`

> ```
> output.logstash:
> hosts: ['localhost:5044']
> ssl.certificate_authorities: ['D:\Elastic\AppLogs\ssl\ca.crt']
> ssl.certificate: 'D:\Elastic\AppLogs\ssl\instance.crt'
> ssl.key: 'D:\Elastic\AppLogs\ssl\instance.key'
> 
> ```

Then `logstash-pipeline.conf`

> ```
> ssl => true
> ssl_certificate_authorities => ['D:\Elastic\AppLogs\ssl\ca.crt']
> ssl_certificate => 'D:\Elastic\AppLogs\ssl\instance.crt'
> ssl_key => 'D:\Elastic\AppLogs\ssl\instance.key'
> ssl_verify_mode => "force_peer"
> 
> ```

When run the logstash, produced error:

> ```
> Looks like you either have a bad certificate, an invalid key or your private key was not in PKCS8 format.
> 
> ```

Switch the `instance.key` to pkcs8 with:

> ```
> openssl pkcs8 -in privatekey.key -topk8 -nocrypt -out privatekey.p8
> 
> ```

Update `filebeat.yml` and `logstash-pipeline.conf` accordingly.  
Run again logstash & filebeat, produced error:

> ```
> Handling exception: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE
> 
> ```

Please help me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 8, 2019, 9:57am UTC](https://discuss.elastic.co/t/setting-up-secure-connection-between-filebeat-and-logstash/189959/2 "2019-08-08T09:57:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.