# TLS/SSL for logstash 5.6

**URL:** <https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783>\
**Category:** Logstash\
**Tags:** elastic-stack-security\
**Created:** [February 18, 2019, 8:33am UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783 "2019-02-18T08:33:32Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [February 18, 2019, 8:33am UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/1 "2019-02-18T08:33:32Z")

</div>

All,

We have tried by adding TLS CA certificate which we already generated for ES cluster.

When we add the parameters in logstash configuration file as per below doc

`https://www.elastic.co/guide/en/x-pack/5.6/logstash.html`

We see errors in log files and logstash could not able to establish the pipeline. Below are the errors

```
[2019-02-17T05:19:41,166][ERROR][logstash.outputs.elasticsearch] Invalid setting for elasticsearch output plugin:

  output {
    elasticsearch {
      # This setting must be a path
      # File does not exist or cannot be opened /etc/logstash/certs/cert.pem
      cacert => "/etc/logstash/certs/cert.pem"
      ...
    }
  }
[2019-02-17T05:19:41,172][ERROR][logstash.agent] Cannot create pipeline {:reason=>"Something is wrong with your configuration."}

```

Please help any one has done TLS/SSL enable at logstash level

Thanks

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 18, 2019, 8:44am UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/2 "2019-02-18T08:44:12Z")

</div>

Please add your complete Elasticsearch output plugin configuration

```auto
# File does not exist or cannot be opened /etc/logstash/certs/cert.pem

```

Does the file exist ? Does the user that logstash process runs under has the necessary permissions to open the file ?

What's the output of

```auto
ls -l /etc/logstash/certs/cert.pem

```

---

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [February 18, 2019, 9:35am UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/3 "2019-02-18T09:35:04Z")

</div>

Yes, the file is existed and given 755 permissions

the log stash service is running from root user

Thanks

---

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [February 26, 2019, 10:18am UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/4 "2019-02-26T10:18:27Z")

</div>

After fixing few issues now i see below error in logstash log file

`[2019-02-26T03:03:24,541][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://logstash_user:xxxxxx@localhost:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [https://logstash_user:xxxxxx@localhost:9200/][Manticore::ClientProtocolException] Received fatal alert: bad_certificate"}`

any suggestions please to fix this issue

Thanks

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 26, 2019, 2:35pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/5 "2019-02-26T14:35:21Z")

</div>

> [@ikakavas](#):
>
> Please add your complete Elasticsearch output plugin configuration

> [@prabhakar\_talari](#):
>
> [Manticore::ClientProtocolException] Received fatal alert: bad\_certificate"}

Logstash says that it doesn't like the certificate of Elasticsearch. This can happen for a number of reasons, please share the relevant parts of your Logstash configuration, your Elasticsearch configuration and the elasticsearch logs. Otherwise it's really hard to guess what could be going on

---

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [February 26, 2019, 2:52pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/6 "2019-02-26T14:52:37Z")

</div>

Here is the ouput plugin from logstash config

```
output {
        elasticsearch
        { hosts => ["hsotname1:9200","hsotname2:9200"]
                user => "logstash_user"
                password => "XXXXXXXXX"
                index => "indexname"
				ssl => true
                cacert => "/etc/logstash/certs/ca.pem"
        }
}
```

---

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [February 26, 2019, 2:53pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/7 "2019-02-26T14:53:26Z")

</div>

Below are the parameters i have added in elasticsearch.yml file

```
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.client_authentication: required
```

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 26, 2019, 3:01pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/8 "2019-02-26T15:01:42Z")

</div>

> [@prabhakar\_talari](#):
>
> xpack.security.http.ssl.client\_authentication: required

See [Security settings in Elasticsearch | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html) from which I copy:

> Controls the server’s behavior in regard to requesting a certificate from client connections. Valid values are `required` , `optional` , and `none` . `required` forces a client to present a certificate, while `optional` requests a client certificate but the client is not required to present one. Defaults to `none` .

By setting this to `required` you declare that Logstash (and anything else that connects to Elasticsearch via http ) should authenticate with a client certificate and key. Is this what you want ?  
Because your logstash elasticsearch output plugin configuration seems to imply that you want to authenticate with a username and password, and not with a client certificate.

Can you describe what you want to achieve so that we can help you get there?

---

<div class="post-metadata">

**Author:** ![prabhakar\_talari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/prabhakar_talari/32/46469_2.png) [@prabhakar\_talari](https://discuss.elastic.co/u/prabhakar_talari)\
**Post date:** [February 26, 2019, 3:31pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/9 "2019-02-26T15:31:34Z")

</div>

Hi,

Thank you for your prompt response.

I am trying to enable TLS from log stash to Elastic search. Currently am authenticating with user & password and along with that i would like to add SSL certification as well.

Please suggest.

Thanks

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 26, 2019, 3:45pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/10 "2019-02-26T15:45:36Z")

</div>

> [@prabhakar\_talari](#):
>
> add SSL certification

Hi, can you add more details? Do you want to protect the communication with TLS ( this provides integrity and confidentiality to the communication between Logstash and Elasticsearch) or do you also want to authenticate Logstash with a client certificate instead of username/password ? Do you have an explicit requirement for the latter?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2019, 3:45pm UTC](https://discuss.elastic.co/t/tls-ssl-for-logstash-5-6/168783/11 "2019-03-26T15:45:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.