# SSL-enabled Beat ssl\_verify\_mode =\> "none" not working as expected
**URL:** https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023
**Category:** Logstash
**Created:** [February 19, 2020, 4:22pm UTC](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023 "2020-02-19T16:22:18Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@DougR](https://discuss.elastic.co/u/DougR)
#### Post date: [February 19, 2020, 4:22pm UTC](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023/1 "2020-02-19T16:22:19Z")
# TL;DR
Using `ssl_verify_mode => "none"` in `input.beats` not functioning as expected; should allow unverified SSL connections, but doesn't.
# The rest of the story...
I'm using SSL-enabled `input.beat` in my logstash.conf, which is written as follows:
```auto
input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/ssl/elk/cert.pem"
ssl_certificate_authorities => [
"/etc/ssl/elk/ca_root.pem",
"/etc/ssl/elk/ca_int.pem"
]
ssl_key => "/etc/ssl/elk/key-p8.pem"
ssl_verify_mode => "none"
}
}
```
When I configure a beat with the following, it connects:
```auto
output:
logstash:
index: metricbeat
hosts:
- logstash:5044
ssl:
enabled: true
verification_mode: none
certificate: /etc/ssl/elk/cert.pem
certificate_authorities:
- /etc/ssl/elk/ca_root.pem
- /etc/ssl/elk/ca_int.pem
key: /etc/ssl/elk/key-p8.pem
```
However, when I commment out the following lines:
```auto
output:
logstash:
index: metricbeat
hosts:
- logstash:5044
ssl:
enabled: true
verification_mode: none
# certificate: /etc/ssl/elk/cert.pem
# certificate_authorities:
# - /etc/ssl/elk/ca_root.pem
# - /etc/ssl/elk/ca_int.pem
# key: /etc/ssl/elk/key-p8.pem
```
I get the following error in the log:
```auto
2020-02-19T15:39:42.315Z ERROR pipeline/output.go:100 Failed to connect to backoff(async(tcp://logstash:5044)): remote error: tls: handshake failure
```
Based on my understanding, `ssl_verify_mode => "none"` means that there is no client verification; the input should accept all connection requests via SSL.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 19, 2020, 7:06pm UTC](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023/2 "2020-02-19T19:06:06Z")
> [@DougR](#):
>
> Using `ssl_verify_mode => "none"` in `input.beats` not functioning as expected; should allow unverified SSL connections, but doesn't.
Yes, [that's true](https://github.com/logstash-plugins/logstash-input-beats/issues/196).
---
### Author:  [@DougR](https://discuss.elastic.co/u/DougR)
#### Post date: [February 19, 2020, 8:05pm UTC](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023/3 "2020-02-19T20:05:17Z")
Thank you for the pointer. Since I wasn't able to locate that ticket while searching, I'm going to link to it [here](https://github.com/logstash-plugins/logstash-input-beats/issues/196) and summarize:
- If you set `ssl.certificate.authorities => [...]`, logstash will ignore `ssl_verify_mode => "none"` and do a `force_peer` verification.
- In order to utilize `ssl_verify_mode => "none"`, **do not** set `ssl.certificate.authorities`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 18, 2020, 8:11pm UTC](https://discuss.elastic.co/t/ssl-enabled-beat-ssl-verify-mode-none-not-working-as-expected/220023/4 "2020-03-18T20:11:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.