# SSL configuration assistance

**URL:** <https://discuss.elastic.co/t/ssl-configuration-assistance/304778>\
**Category:** Beats\
**Tags:** filebeat, metricbeat, winlogbeat\
**Created:** [May 16, 2022, 5:26am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778 "2022-05-16T05:26:28Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajvel](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajvel](https://discuss.elastic.co/u/rajvel)\
**Post date:** [May 16, 2022, 5:26am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/1 "2022-05-16T05:26:29Z")

</div>

Hello Team,

We are having a single node ELK configuration, In the same server we have installed Elasticsearch logstash and kibana (8.0.1) (on-premises)

As per the guide if we are installing the elasticsearch generates own SSL configuration default.

The elasticsearch certs are,  
in /etc/elasticsearch/certs/  
total 24  
-rw-rw----. 1 root elasticsearch 1915 Apr 29 12:33 http\_ca.crt  
-rw-rw----. 1 root elasticsearch 10013 Apr 29 12:33 http.p12  
-rw-rw----. 1 root elasticsearch 5822 Apr 29 12:33 transport.p12

i have tried to configure the output.elasticsearch in metricbeat in the same server,  
Metricbeat configuration:

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

# Array of hosts to connect to.

hosts: ["[https://sgelastic.saint-gobain.com:9200](https://sgelastic.saint-gobain.com:9200)"]

# Protocol - either `http` (default) or `https`.

#protocol: "https"

# Authentication credentials - either API key or username/password.

#api\_key: "id:api\_key"  
username: "metricbeat\_sg"  
password: "${MB\_PWD}"  
#ssl.verification\_mode: true  
ssl.certificate\_authorities: ["/etc/elasticsearch/certs/http\_ca.crt"]  
ssl.certificate: "/etc/elasticsearch/certs/transport.p12"  
ssl.key: "/etc/elasticsearch/elasticsearch.keystore"

elasticesearch.yml configuration:

#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------

# 

# The following settings, TLS certificates, and keys have been automatically

# generated to configure Elasticsearch security features on 29-04-2022 07:03:14

# 

# --------------------------------------------------------------------------------

# Enable security features

xpack.security.enabled: true

xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents

xpack.security.http.ssl:  
enabled: true  
keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes

xpack.security.transport.ssl:  
enabled: true  
verification\_mode: certificate  
keystore.path: certs/transport.p12  
truststore.path: certs/transport.p12

# Create a new cluster with the current node only

# Additional nodes can still join the cluster later

cluster.initial\_master\_nodes: ["L04ELKChe001"]

# Allow HTTP API connections from localhost and local networks

# Connections are encrypted and require user authentication

http.host: [_local_, _site_]

# Allow other nodes to join the cluster from localhost and local networks

# Connections are encrypted and mutually authenticated

#transport.host: [_local_, _site_]

#----------------------- END SECURITY AUTO CONFIGURATION -------------------------

While we try the metricbeat -e the below error i am facing, please guide me to fix this issue  
{"log.level":"error","@timestamp":"2022-05-16T15:21:57.508+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls.go","file.line":53},"message":"Failed reading certificate file /etc/elasticsearch/certs/transport.p12: no pem file","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"info","@timestamp":"2022-05-16T15:21:57.509+0530","log.origin":{"file.name":"instance/beat.go","file.line":458},"message":"metricbeat stopped.","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"error","@timestamp":"2022-05-16T15:21:57.509+0530","log.origin":{"file.name":"instance/beat.go","file.line":1023},"message":"Exiting: error initializing publisher: 1 error: no pem file /etc/elasticsearch/certs/transport.p12 accessing 'output.elasticsearch' (source:'/etc/metricbeat/metricbeat.yml')","service.name":"metricbeat","ecs.version":"1.6.0"}  
Exiting: error initializing publisher: 1 error: no pem file /etc/elasticsearch/certs/transport.p12 accessing 'output.elasticsearch' (source:'/etc/metricbeat/metricbeat.yml')  
{"log.level":"error","@timestamp":"2022-05-16T15:21:57.508+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls.go","file.line":53},"message":"Failed reading certificate file /etc/elasticsearch/certs/transport.p12: no pem file","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"info","@timestamp":"2022-05-16T15:21:57.509+0530","log.origin":{"file.name":"instance/beat.go","file.line":458},"message":"metricbeat stopped.","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"error","@timestamp":"2022-05-16T15:21:57.509+0530","log.origin":{"file.name":"instance/beat.go","file.line":1023},"message":"Exiting: error initializing publisher: 1 error: no pem file /etc/elasticsearch/certs/transport.p12 accessing 'output.elasticsearch' (source:'/etc/metricbeat/metricbeat.yml')","service.name":"metricbeat","ecs.version":"1.6.0"}  
Exiting: error initializing publisher: 1 error: no pem file /etc/elasticsearch/certs/transport.p12 accessing 'output.elasticsearch' (source:'/etc/metricbeat/metricbeat.yml')

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 16, 2022, 6:11am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/2 "2022-05-16T06:11:41Z")

</div>

The certs may not being able to be read by the filebeat user

Try  
`sudo chmod 666 /etc/Elasticsearch/certs/*`

`sudo chmod 777 /etc/Elasticsearch/certs`

---

<div class="post-metadata">

**Author:** ![rajvel](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajvel](https://discuss.elastic.co/u/rajvel)\
**Post date:** [May 16, 2022, 7:06am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/3 "2022-05-16T07:06:35Z")

</div>

No Luck.

{"log.level":"info","@timestamp":"2022-05-16T18:05:08.715+0530","log.logger":"beat","log.origin":{"file.name":"instance/beat.go","file.line":1093},"message":"Process info","service.name":"metricbeat","system\_info":{"process":{"capabilities":{"inheritable":null,"permitted":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"effective":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"bounding":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"ambient":null},"cwd":"/etc/Elasticsearch","exe":"/usr/share/metricbeat/bin/metricbeat","name":"metricbeat","pid":594367,"ppid":456065,"seccomp":{"mode":"filter","no\_new\_privs":true},"start\_time":"2022-05-16T18:05:04.810+0530"},"ecs.version":"1.6.0"}}  
{"log.level":"info","@timestamp":"2022-05-16T18:05:08.715+0530","log.origin":{"file.name":"instance/beat.go","file.line":323},"message":"Setup Beat: metricbeat; Version: 8.1.0","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"warn","@timestamp":"2022-05-16T18:05:08.717+0530","log.logger":"cfgwarn","log.origin":{"file.name":"tlscommon/config.go","file.line":102},"message":"DEPRECATED: Treating the CommonName field on X.509 certificates as a host name when no Subject Alternative Names are present is going to be removed. Please update your certificates if needed. Will be removed in version: 8.0.0","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"error","@timestamp":"2022-05-16T18:05:08.717+0530","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls.go","file.line":53},"message":"Failed reading certificate file /etc/Elasticsearch/certs/transport.p12: no pem file","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"info","@timestamp":"2022-05-16T18:05:08.717+0530","log.origin":{"file.name":"instance/beat.go","file.line":458},"message":"metricbeat stopped.","service.name":"metricbeat","ecs.version":"1.6.0"}  
{"log.level":"error","@timestamp":"2022-05-16T18:05:08.717+0530","log.origin":{"file.name":"instance/beat.go","file.line":1023},"message":"Exiting: error initializing publisher: 1 error: no pem file /etc/Elasticsearch/certs/transport.p12 accessing 'output.Elasticsearch' (source:'/etc/metricbeat/metricbeat.yml')","service.name":"metricbeat","ecs.version":"1.6.0"}  
Exiting: error initializing publisher: 1 error: no pem file /etc/Elasticsearch/certs/transport.p12 accessing 'output.Elasticsearch' (source:'/etc/metricbeat/metricbeat.yml')

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [May 16, 2022, 7:54am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/4 "2022-05-16T07:54:25Z")

</div>

Your metricbeat configuration is wrong:

```auto
ssl.certificate_authorities: ["/etc/Elasticsearch/certs/http_ca.crt"]
ssl.certificate: "/etc/Elasticsearch/certs/transport.p12"
ssl.key: "/etc/Elasticsearch/Elasticsearch.keystore"

```

and the error tells you why:

> [@rajvel](#):
>
> {"file.name":"tlscommon/tls.go","file.line":53},"message":"Failed reading certificate file /etc/Elasticsearch/certs/transport.p12: no pem

```auto
ssl.certificate

```

takes a PEM encoded client certificate as its value, not a PKCS12 keystore.

Do you **know** that you **need** TLS _client_ authentication _from_ metricbeat _to_ elasticsearch ? I would assume that you don't and so you can just comment out

```auto
#ssl.certificate: "/etc/Elasticsearch/certs/transport.p12"
#ssl.key: "/etc/Elasticsearch/Elasticsearch.keystore"

```

---

<div class="post-metadata">

**Author:** ![rajvel](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajvel](https://discuss.elastic.co/u/rajvel)\
**Post date:** [May 16, 2022, 8:04am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/5 "2022-05-16T08:04:53Z")

</div>

The metricbeat runs on different server and need the TLS authentication between source and destination.

We have signed certificate for kibana, shall i use the same for Elasticsearch and logstash?  
Please advise.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [May 17, 2022, 3:06am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/6 "2022-05-17T03:06:49Z")

</div>

> [@rajvel](#):
>
> The metricbeat runs on different server and need the TLS authentication between source and destination.

Sure, but you don't necessarily need TLS client authentication ( mutual TLS ). Filebeat can authenticate to Elasticsearch in a different set of ways, take a look at the docs in [Configure the Elasticsearch output | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html#elasticsearch-output) and [Secure communication with Elasticsearch | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/securing-communication-elasticsearch.html) . The connection will still be encrypted via TLS but filebeat will authenticate itself to Elasticsearch with credentials or an API key, instead of a client cert. This is usually much simpler unless you have specific requirements to use client TLS authentication.

> [@rajvel](#):
>
> We have signed certificate for kibana, shall i use the same for Elasticsearch and logstash?  
> Please advise.

You should probably not re-use client certificates for different clients. If you absolutely want to use client TLS for filebeat ( and not some other form of authentication ) then you first need to set up a PKI realm in Elasticsearch ( [PKI user authentication | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/pki-realm.html) ) and then generate a new client key and cert for filebeat to use.

---

<div class="post-metadata">

**Author:** ![rajvel](https://avatars.discourse-cdn.com/v4/letter/r/e9c0ed/32.png) [@rajvel](https://discuss.elastic.co/u/rajvel)\
**Post date:** [May 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/7 "2022-05-17T09:51:16Z")

</div>

Hello,

Still we need to communicate via client certificate, as per the document Elasticsearch 8.1.0 have own certificate while we install.  
The location of the Elasticsearch certs are ,  
/etc/Elasticsearch/certs/  
total 24  
-rw-rw----. 1 root Elasticsearch 1915 Apr 29 12:33 http\_ca.crt  
-rw-rw----. 1 root Elasticsearch 10013 Apr 29 12:33 http.p12  
-rw-rw----. 1 root Elasticsearch 5822 Apr 29 12:33 transport.p12

If i configure the http.p12 in filebeat from destination server its not communicating , unknown certificate error.

Please advise.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2022, 11:51am UTC](https://discuss.elastic.co/t/ssl-configuration-assistance/304778/8 "2022-06-14T11:51:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.