# TCP FIN when using TLS

**URL:** <https://discuss.elastic.co/t/tcp-fin-when-using-tls/164510>\
**Category:** Logstash\
**Created:** [January 16, 2019, 4:53pm UTC](https://discuss.elastic.co/t/tcp-fin-when-using-tls/164510 "2019-01-16T16:53:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nich](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nich](https://discuss.elastic.co/u/nich)\
**Post date:** [January 16, 2019, 4:53pm UTC](https://discuss.elastic.co/t/tcp-fin-when-using-tls/164510/1 "2019-01-16T16:53:32Z")

</div>

We are using Logstash to accept TLS encrypted TCP syslog messages from various devices. Some work fine, but some don't. Looking at a packet capture, we can see that after the TLS handshake, Logstash sends a TCP FIN, just as the client is about to send its data. We have increased the log level in Logstash to debug, but there is nothing in the logs related to this issue. We have a local certificate authority and all devices have the CA cert installed. I was wondering if anybody else had experienced something similar, or had any pointers on things to investigate further? Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 16, 2019, 5:38pm UTC](https://discuss.elastic.co/t/tcp-fin-when-using-tls/164510/2 "2019-01-16T17:38:38Z")

</div>

Are you doing this with a TCP input? Did you unset ssl\_verify? The TCP input requires a client certificate by default. If you don't submit one with the client hello I would expect it to drop the connection.

logstash relies on other code (netty) to negotiate and implement TLS, so it will never log anything more than the configuration it passes to netty.

---

<div class="post-metadata">

**Author:** ![nich](https://avatars.discourse-cdn.com/v4/letter/n/e79b87/32.png) [@nich](https://discuss.elastic.co/u/nich)\
**Post date:** [January 18, 2019, 5:08pm UTC](https://discuss.elastic.co/t/tcp-fin-when-using-tls/164510/3 "2019-01-18T17:08:59Z")

</div>

Yes, we are using a TCP input. We already have unset ssl\_verify, but thanks for the reminder because that could easily have been the cause.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 15, 2019, 5:09pm UTC](https://discuss.elastic.co/t/tcp-fin-when-using-tls/164510/4 "2019-02-15T17:09:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.