# SSL communication between Filebeat and Kafka **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 3, 2018, 3:55am UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303 "2018-07-03T03:55:30Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![SubashKunjupillai](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Post date:** [July 3, 2018, 3:55am UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/1 "2018-07-03T03:55:30Z")
Hi All, We have a cluster where we have 2-way SSL authentication enabled in Kafka. Also we have log management setup in the same cluster like FileBeat --\> Kafka --\> Logstash --\> ElasticSearch --\> Kibana. Now since SSL is enabled in Kafka, client (FileBeat and Logstash) should be enabled with SSL option. Though I'm clear to certain level how Kafka SSL works with keystore and truststore, I'm not able to understand how Filebeat should be configured with the CA of Kafka. Can someone give detailed explanation on what are the files I've to pass on to the below configurations in filebeat.yml. ssl.certificate\_authorities ssl.certificate ssl.key Regards, Subash Kunjupillai ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 3, 2018, 11:00am UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/2 "2018-07-03T11:00:28Z")
Hi, - `ssl.certificate_authorities`: This is a list of certificates that the Beat will trust. So you put in here the root certificate that signed the certificate that Kafka uses. - `ssl.certificate`: This is the client-side certificate. As you are using 2-way authentication, here you have to put the certificate that identifies the Beat. - `ssl.key`: This is the private key for the certificate in `ssl.certificate`. ---
**Author:** ![SubashKunjupillai](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Post date:** [July 4, 2018, 5:21pm UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/3 "2018-07-04T17:21:56Z")
Hi Adrisr, Thanks for sharing the details. To start off, I just tried to add the CA of Kafka in ssl.certificate\_authorities so that encryption of data will happen. But on doing so, I'm getting the "x509 : cannot validate certificate for [Public IP] because it doesn't contain any IP SANs" error in Filebeat log. ![kafka_log](https://us1.discourse-cdn.com/elastic/original/3X/e/f/efd2fe5f65fbf33cab9d7db275c3dc3e2971a509.png) I'm sure that I've set SAN with the public IP of the respective Kafka broker machines and I've validated them before signing the certificate with CA. Can you please help me to understand where I would be going wrong. Regards, Subash Kunjupillai ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 5, 2018, 10:07am UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/4 "2018-07-05T10:07:08Z")
can you double-check that the certificate contains the IP SANs? You can get the certificate with: > openssl s\_client -showcerts -connect IP:9093 ---
**Author:** ![SubashKunjupillai](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Post date:** [July 6, 2018, 5:30pm UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/5 "2018-07-06T17:30:01Z")
Hi Adrisr, On running the above command, I'm getting the below > openssl s\_client -showcerts -connect XX.XX.XX.115:9093 > CONNECTED(00000003) > depth=0 C = XX, ST = XX, L = XX, O = XXXX, OU = XX, CN = \* > verify error:num=18:self signed certificate > verify return:1 > depth=0 C = XX, ST = XX, L = XX, O = XXXX, OU = XX, CN = \* > verify return:1 > Certificate chain > 0 s:/C=XX/ST=XX/L=XX/O=XXXX/OU=XX/CN=\* > i:/C=XX/ST=XX/L=XX/O=XXXX/OU=XX/CN=\* > -----BEGIN CERTIFICATE----- > MIIDJDCCAgwCCQC13GlMA2vKPzANBgkqhkiG9w0BAQUFADBUMQswCQYDVQQGEwJT > VzELMAkGA1UECAwCS0ExCzAJBgNVBAcMAktBMREwDwYDVQQKDAhFcmljc3NvbjEM > MAoGA1UECwwDQ1JTMQowCAYDVQQDDAEqMB4XDTE4MDcwNjE3MTYyN1oXDTI4MDcw > MzE3MTYyN1owVDELMAkGA1UEBhMCU1cxCzAJBgNVBAgTAktBMQswCQYDVQQHEwJL > QTERMA8GA1UEChMIRXJpY3Nzb24xDDAKBgNVBAsTA0NSUzEKMAgGA1UEAwwBKjCC > ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMO5YHnHocbmN+zg/Qqq+aUJ > vQ9w1lTMfP6BHuobG2xd20hoXsj+DpdDrBry+iF1MvuOC+xYl25ODb7WhllVO+bz > kwPh1bbjGe7+PGKu3cLIAK9WWnlt3KCx0UsUhF7HuG9YcbpNz+xxjb6wlH0q4cre > QT9Q4aNhLn67HUA/ZjEXA9OEzxyiqEctYPGZIpkcn98jmymS+aEIBkiWGUS45+Cj > fg4jqy6Ow7vmC/3qndQ0iU4zxZgGkjhLwc7a30CNfQa3jBHj24ajOzAVb1US/hCZ > X2Y1QOVDLa6hfMkEXUivoD60nbcGLajS3WmJIer4FP/FZKACVoclrVkTELFI3GMC > AwEAATANBgkqhkiG9w0BAQUFAAOCAQEAr0Pnf/UHjVfWQWfSlSP4DQIoL5LesFY+ > qRqY9db4j0Msg1q91zRoUiioe7w5Vw5Nd78bwwLpBFmFqbKga7ymid42+ZMglc/d > /laiv1TxbCdEQjnLIxOtQJ7gFysxV+XwKsCqUSQHYaTjOibuPR2LbbzTCO17PRMy > b+vuhD6+WBlpefBArm+3HildWQz7qn5Zt/PB1oANU0HwkMOyDa9dpoTiM2yjndsK > 1Y1mnfRLm/+a9Z9q/VGwNBQPBT/xI/QgaGtE1k/3gJUn/vOuJ6lLM4D/b3wPcI+J > KKhWpDEH3rUKyoQTpWHeN4x+a3P0iKl7B06cv+ONpCoa8HutL5hv0w== > -----END CERTIFICATE----- > 1 s:/C=XX/ST=XX/L=XX/O=XXXX/OU=XX/CN=\* > i:/C=XX/ST=XX/L=XX/O=XXXX/OU=XX/CN=\* > -----BEGIN CERTIFICATE----- > MIIDezCCAmOgAwIBAgIJAOeDYHjSIpe4MA0GCSqGSIb3DQEBCwUAMFQxCzAJBgNV > BAYTAlNXMQswCQYDVQQIDAJLQTELMAkGA1UEBwwCS0ExETAPBgNVBAoMCEVyaWNz > c29uMQwwCgYDVQQLDANDUlMxCjAIBgNVBAMMASowHhcNMTgwNzA2MTcxNjE1WhcN > MjgwNzAzMTcxNjE1WjBUMQswCQYDVQQGEwJTVzELMAkGA1UECAwCS0ExCzAJBgNV > BAcMAktBMREwDwYDVQQKDAhFcmljc3NvbjEMMAoGA1UECwwDQ1JTMQowCAYDVQQD > DAEqMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5mey7Asqpk+muzH5 > et7xtGW+3hZlZDrv6FWd5GneFCucF/GGjY3yTEqlHa5wxth8HIUNYcCS2tQjSsmv > jxAlhE7lF5R/iUgYvlC+LTvCP2q/g1us5TK+eCwVhQAL4QAf9igytvBE/Fsnn6fX > AM1EkPDbnUP1I+fPPHgFRdF6geRVTEUc1SR/LOAZbLzahGQ5WMt53GRj5xs08WEn > zD9eWeZPKTSP97q4jhG9JFkeZwFXFN5Xzif+podLIzM0LTBD04xSuIsH+A6XT+Bf > LS3QKjDs0PART9po+pSZKdI3Gv+gLGgUOjkwOAFyJMCi0g6Z5JsxmsRD8ae+WScg > CS64vwIDAQABo1AwTjAdBgNVHQ4EFgQUgs1yRIV0x6s3dZkIAGbATjFjDCgwHwYD > VR0jBBgwFoAUgs1yRIV0x6s3dZkIAGbATjFjDCgwDAYDVR0TBAUwAwEB/zANBgkq > hkiG9w0BAQsFAAOCAQEAErCcrBhHEEm7aNQpTnjTZd8I/3oGAju2bdw1ysqYKZLQ > spVFU20gvHAshMCg/+fTBcKVwDkzsjP1TDeuQ81SOyWHWNtNGsuVdsJN8oIxx5AG > Llv0WkedazvxG3GamxK8vtiitjgwDdS/K4cT5HTredCiGEbD5Qft2LYleMpqGzRo > 84xICYEgSZpHEY29QXqcM0kWiz6jo+TGtjRtCHBeawdfQb2OuzexkOoKOadj4liH > 8DzGIoFE2RBbjc7kd6idUgxh9Uenra/ks7uhf6IFjztAvGMPPEY9qt0CPR+cPYIn > kykBKeYZ1MsPxYlrQGqeYcnz6bM/6G58JIjTAOitlQ== > -----END CERTIFICATE----- > Server certificate > subject=/C=XX/ST=XX/L=XX/O=XXXX/OU=XX/CN=\* > issuer=/C=XX/ST=XX/L=XX/O=XXXX/OU=XX/CN=\* > No client certificate CA names sent > Server Temp Key: ECDH, secp521r1, 521 bits > SSL handshake has read 2258 bytes and written 441 bytes > New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 > Server public key is 2048 bit > Secure Renegotiation IS supported > Compression: NONE > Expansion: NONE > SSL-Session: > Protocol : TLSv1.2 > Cipher : ECDHE-RSA-AES128-GCM-SHA256 > Session-ID: 5B3FA65DDE9A09886C1A725F46758274B810610F1DF11D23811773D44362A7F3 > Session-ID-ctx: > Master-Key: 8105A8F49419A1D6AB3C06810FB3CCCF0A668DC7F812A9D5B2379AE7BAC4BEC0270A47C68E8A1B4549845E1B49CD2BF8 > Key-Arg : None > Krb5 Principal: None > PSK identity: None > PSK identity hint: None > Start Time: 1530898013 > Timeout : 300 (sec) > Verify return code: 18 (self signed certificate) ---
**Author:** ![SubashKunjupillai](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@SubashKunjupillai](https://discuss.elastic.co/u/SubashKunjupillai)\ **Post date:** [July 7, 2018, 4:06pm UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/6 "2018-07-07T16:06:21Z")
The SAN was not set by the CA while signing the CSR. By following this [link](https://blog.zencoffee.org/2013/04/creating-and-signing-an-ssl-cert-with-alternative-names/) I was able to set SAN in the signed certificate. Thanks a lot for your help! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 4, 2018, 4:06pm UTC](https://discuss.elastic.co/t/ssl-communication-between-filebeat-and-kafka/138303/7 "2018-08-04T16:06:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.