# SSL with Filebeat not working **URL:** \ **Category:** Logstash\ **Created:** [April 16, 2018, 3:42pm UTC](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/128225 "2018-04-16T15:42:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![va1entin](https://avatars.discourse-cdn.com/v4/letter/v/54ee81/32.png) [@va1entin](https://discuss.elastic.co/u/va1entin)\ **Post date:** [April 16, 2018, 3:42pm UTC](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/128225/1 "2018-04-16T15:42:39Z")
Hey folks, I tried to get SSL working between Logstash and Filebeat but ran out of ideas now. I have two servers in my test case. Both use self-signed certificates from the same CA. The configs look as follows: Logstash: ``` input { beats { port => 5044 ssl => true ssl_certificate_authorities => ["/usr/share/logstash/CAcert.pem"] ssl_certificate => "/usr/share/logstash/cert.pem" ssl_key => "/usr/share/logstash/private.key" } } ``` Filebeat: ``` output.logstash: hosts: ["10.200.14.80:5044"] ssl.enabled: true ssl.certificate_authorities: "/usr/share/filebeat/CAcert.pem" ssl.certificate: "/usr/share/filebeat/cert.pem" ssl.key: "/usr/share/filebeat/private.key" ``` I keep getting this error from Logstash: ``` [2018-04-16T15:37:48,608][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:5044, remote: undefined] Handling exception: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE [2018-04-16T15:37:48,608][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception. io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:935) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:141) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_161] Caused by: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.shutdownWithError(ReferenceCountedOpenSslEngine.java:876) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.sslReadErrorResult(ReferenceCountedOpenSslEngine.java:1124) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1080) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1146) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1189) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.SslHandler$SslEngineType$1.unwrap(SslHandler.java:216) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1248) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.SslHandler.decodeNonJdkCompatible(SslHandler.java:1171) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1196) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-all-4.1.18.Final.jar:4.1.18.Final] ``` I tried to use curl for testing before but that does not work either: ``` curl -v --cacert CAcert.pem https://master.elk.demo:5044 * Rebuilt URL to: https://master.elk.demo:5044/ * Trying 10.200.14.80... * Connected to master.elk.demo (10.200.14.80) port 5044 (#0) * found 1 certificates in CAcert.pem * found 598 certificates in /etc/ssl/certs * ALPN, offering http/1.1 * gnutls_handshake() failed: Handshake failed * Closing connection 0 curl: (35) gnutls_handshake() failed: Handshake failed ``` Without SSL everything works just as intended. Any help would be greatly appreciated! EDIT: Got it solved: As you can see above I had an IP address configured as `output.logstash.hosts` in my Filebeat configuration. That was the mistake. After configuring the hostname of the machine instead, it worked. Logstash's error was quite misleading. Still don't know why curl doesn't work though ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [April 18, 2018, 12:23pm UTC](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/128225/2 "2018-04-18T12:23:46Z")
> [@va1entin](#): > > curl -v --cacert CAcert.pem [https://master.elk.demo:5044](https://master.elk.demo:5044) > > - Rebuilt URL to: [https://master.elk.demo:5044/](https://master.elk.demo:5044/) > - Trying 10.200.14.80... > - Connected to master.elk.demo (10.200.14.80) port 5044 (#0) > - found 1 certificates in CAcert.pem > - found 598 certificates in /etc/ssl/certs > - ALPN, offering http/1.1 > - gnutls\_handshake() failed: Handshake failed > - Closing connection 0 > curl: (35) gnutls\_handshake() failed: Handshake failed Glad this got resolved. This is indeed misleading but I can understand that, as the `hosts: ["10.200.14.80:5044"]` is not getting resolved, then yes the certificate will fail. Thus the stack trace above. I wonder what that would of looked like under DEBUG logging. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 16, 2018, 12:24pm UTC](https://discuss.elastic.co/t/ssl-with-filebeat-not-working/128225/3 "2018-05-16T12:24:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.