# Ssl.verification\_mode options for Filebeat 5.6
**URL:** https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978
**Category:** Beats
**Tags:** filebeat
**Created:** [July 28, 2020, 9:22pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978 "2020-07-28T21:22:24Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@alarka](https://discuss.elastic.co/u/alarka)
#### Post date: [July 28, 2020, 9:22pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/1 "2020-07-28T21:22:24Z")
As per Filebeat 7.8, [https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html)
ssl.verification\_mode has 3 options: "full", "certificate" and "none".
For Filebeat 5.6, I do not see the option "certificate". However, is there any other option using which we can verify that the provided certificate is signed by a trusted authority (CA), but not perform any hostname verification?
Thanks,
Alarka.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [July 29, 2020, 7:18am UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/2 "2020-07-29T07:18:34Z")
Filebeat 5.6 is relatively old. I strongly advise you consider to update your setup.
---
### Author:  [@alarka](https://discuss.elastic.co/u/alarka)
#### Post date: [July 29, 2020, 3:48pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/3 "2020-07-29T15:48:09Z")
I just realized that earlier I was looking at Elasticsearch 7.8 version and not Filebeat.
Here is the link for Filebeat latest v7.8
[https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#\_verification\_mode](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#_verification_mode)
And this one also says only "none" and "full" are the 2 options.
```auto
verification_mode
This option controls whether the client verifies server certificates and host names. Valid values are `none` and `full` . If `verification_mode` is set to `none` , all server host names and certificates are accepted. In this mode, TLS-based connections are susceptible to man-in-the-middle attacks. Use this option for testing only.
The default is `full` .
```
Does anyone know how we can bypass the hostname verification then even with the latest version? Thanks
---
### Author:  [@fgjensen](https://discuss.elastic.co/u/fgjensen)
#### Post date: [July 29, 2020, 4:17pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/4 "2020-07-29T16:17:14Z")
Hi @alarka
Why do you want to bypass hostname verification?
In a production system you should always use the verification mode full as suggested by the documentation. However, if you control the infrastructure a wildcard certificate may be an option for your use case
---
### Author:  [@alarka](https://discuss.elastic.co/u/alarka)
#### Post date: [July 29, 2020, 4:20pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/5 "2020-07-29T16:20:41Z")
Hi @fgjensen, this is connecting to internal teams and currently the supporting team does not intend to make any changes. They only suggested we figure out a way to bypass the hostname verification, so now I am looking at how I can do that.
---
### Author:  [@alarka](https://discuss.elastic.co/u/alarka)
#### Post date: [July 29, 2020, 4:29pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/6 "2020-07-29T16:29:12Z")
Elasticsearch [Security settings](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/security-settings.html#ssl-tls-settings) provides this option "certificate" like I mentioned earlier. I wonder even though it is not mentioned under [Filebeat SSL settings](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#_verification_mode), whether it will work or not.
---
### Author:  [@fgjensen](https://discuss.elastic.co/u/fgjensen)
#### Post date: [July 29, 2020, 4:31pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/7 "2020-07-29T16:31:52Z")
Then I think you are left with the verification mode none. The connections are still protected with TLS but basically unsecure for man-in-the-middle attacks, since its for internal use this may not be a problem.
---
### Author:  [@alarka](https://discuss.elastic.co/u/alarka)
#### Post date: [July 29, 2020, 4:37pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/8 "2020-07-29T16:37:26Z")
Oh ! @fgjensen can you explain what you mean by protected with TLS when I set the verification to none?
---
### Author:  [@fgjensen](https://discuss.elastic.co/u/fgjensen)
#### Post date: [July 29, 2020, 7:43pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/9 "2020-07-29T19:43:34Z")
The verification mode controls how the client controls the server certificates. If you have configured the verification mode to none all server names and (TLS) certificates are accepted and the TLS connection established.
You can test the different verification modes with the curl or openssl s\_client tools in debug mode and observe how a TLS connection is established or rejected. It is quite instructive.
---
### Author:  [@alarka](https://discuss.elastic.co/u/alarka)
#### Post date: [July 29, 2020, 7:44pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/10 "2020-07-29T19:44:22Z")
Thank you !
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 26, 2020, 7:44pm UTC](https://discuss.elastic.co/t/ssl-verification-mode-options-for-filebeat-5-6/242978/11 "2020-08-26T19:44:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.