# Transport.go:125: ERR SSL client failed to connect with: EOF **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [November 23, 2015, 6:55am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272 "2015-11-23T06:55:40Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Marco](https://avatars.discourse-cdn.com/v4/letter/m/a698b9/32.png) [@Marco](https://discuss.elastic.co/u/Marco)\ **Post date:** [November 23, 2015, 6:55am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/1 "2015-11-23T06:55:40Z")
I want to migrate from Logstash Forwarder to Filebeat. In my filebeat.yml ``` filebeat: prospectors: - paths: - /var/log/nginxlog/access.20151102.log field: type: nginxaccesslog input_type: log output: logstash: enabled: true hosts: - 10.1.0.239:5050 tls: certificate_authorities: - /etc/pki/tls/certs/logstash-forwarder.crt certificate: /etc/pki/tls/certs/logstash-forwarder.crt certificate_key: /etc/pki/tls/private/logstash-forwarder.key timeout: 15 ``` But when I start the filebeat: ``` # service filebeat restart * Restarting Sends log files to Logstash or directly to Elasticsearch. filebeat 2015/11/23 06:31:46.386897 transport.go:125: ERR SSL client failed to connect with: EOF ``` How can I fix this issue??? help ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 23, 2015, 10:18pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/2 "2015-11-23T22:18:59Z")
I did try to cleanup you config file (indent by 4 spaces for source code) to make it more readable. Whats you logstash input plugin saying? Have you set 'ssl =\> true' in logstash config? Any log output from logstash? Which version of filebeat and logstash are you using? ---
**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\ **Post date:** [November 27, 2015, 6:10am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/3 "2015-11-27T06:10:43Z")
``` output: logstash: enabled: true hosts: ["ls113:5055","ls112:5055"] worker: 16 loadbalance: true tls: disabled: true insecure: true ``` I just upgraded filebeat to the latest nightly built and started to get this error as well... Funny thing is I do not have tls enabled.... ---
**Author:** ![vtst2412](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vtst2412/32/6228_2.png) [@vtst2412](https://discuss.elastic.co/u/vtst2412)\ **Post date:** [November 27, 2015, 6:26am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/4 "2015-11-27T06:26:12Z")
Ah, fixed it. tls is disabled by default in this new build so my tls section from the old yml actually enables it. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [November 27, 2015, 2:16pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/5 "2015-11-27T14:16:42Z")
right, the 'disabled' flag has been removed. In order to disable tls, the section must be missing ---
**Author:** ![inigo](https://avatars.discourse-cdn.com/v4/letter/i/dbc845/32.png) [@inigo](https://discuss.elastic.co/u/inigo)\ **Post date:** [January 18, 2016, 6:51pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/6 "2016-01-18T18:51:35Z")
I'm running into the same problem ssl client connect problem. filebeat 1.0.1 (snip of filebeat.yml) ``` output: logstash: hosts: ["myhost:5445"] tls: certificate_authorities: ["/etc/filebeat/server.crt"] insecure: true ``` Logstash 2.1.1 (snip of logstash.conf) ``` input { beats { port => 5445 ssl => true ssl_certificate => "/projects/logstash/etc/server.crt" ssl_key => "/projects/logstash/etc/server.key" } } ``` Logstash starts without error, but Filebeat gives me the following SSL client connect message when starting: > $ sudo /etc/init.d/filebeat start > Starting filebeat: 2016/01/18 18:15:22.466690 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths > 2016/01/18 18:15:22.475422 transport.go:125: ERR SSL client failed to connect with: EOF > 2016/01/18 18:15:22.475439 outputs.go:111: INFO Activated logstash as output plugin. > 2016/01/18 18:15:22.475511 publish.go:249: INFO Publisher name: w10155 > 2016/01/18 18:15:22.475696 beat.go:107: INFO Init Beat: filebeat; Version: 1.0.1 I have multiple messages in the Filebeat log similar to this: > ... > 2016-01-18T18:15:22Z ERR SSL client failed to connect with: EOF > ... > 2016-01-18T18:15:22Z INFO Start sending events to output > 2016-01-18T18:15:22Z ERR SSL client failed to connect with: EOF > 2016-01-18T18:15:22Z INFO Connecting error publishing events (retrying): EOF > 2016-01-18T18:15:22Z INFO send fail > ... I've been trying multiple configurations, so I may just be blind to a simple mistake at this point. Any help is appreciated! Note: I should add that communication does work fine without the SSL/TLS configuration. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [January 18, 2016, 11:55pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/7 "2016-01-18T23:55:12Z")
have you checked the logstash error log after filbeat connection failed? The EOF (end-of-file) indicates the connection has been closed by the remote (in this case logstash or firewall) during SSL connection setup. ---
**Author:** ![Jakub\_Juraszek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakub_juraszek/32/47927_2.png) [@Jakub\_Juraszek](https://discuss.elastic.co/u/Jakub_Juraszek)\ **Post date:** [April 26, 2016, 11:18am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/8 "2016-04-26T11:18:35Z")
I had similar(?) problem with msg: ERR SSL client failed to connect with: EOF After long searching I found that my issue was that my client cert expired. Neither filebeat nor logstash produce any INFO,WARNING.ERROR that would point u to this even in debug mode. I think at least one or both of those endpoints should log this - WARNING for logstash, ERROR for filebeat. I took me a lot of time especially that I did check with openssl s\_client and it also was returning that every thing is just ok + disconnected. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 26, 2016, 2:15pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/9 "2016-04-26T14:15:51Z")
@Jakub_Juraszek Thanks for having such a detailed look. I'm a little surprised myself libs do not report an error when using an outdated certificate. This should definitely print a log message (ERROR or CRITICAL level, is this blocks processing). Problem is, with EOF from 'Connect' method, me as library user get no chance to even see the parsed certificate I'm afraid (have to check docs if there is some hook). All beats can do is checking certificates on load time, which will not get you the full picture if beats has some root/intermediate CA certificate only. In order to check peer certificate I need a successful handshake first. Can you please add a ticket to [github.com/elastic/beats/issues](http://github.com/elastic/beats/issues) and [https://github.com/logstash-plugins/logstash-input-beats/issues](https://github.com/logstash-plugins/logstash-input-beats/issues) including details (e.g. open ssl commands) you used for testing? Thanks. ---
**Author:** ![Jakub\_Juraszek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakub_juraszek/32/47927_2.png) [@Jakub\_Juraszek](https://discuss.elastic.co/u/Jakub_Juraszek)\ **Post date:** [April 27, 2016, 9:38am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/10 "2016-04-27T09:38:29Z")
submited [https://github.com/logstash-plugins/logstash-input-beats/issues/80](https://github.com/logstash-plugins/logstash-input-beats/issues/80) ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [April 27, 2016, 2:51pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/11 "2016-04-27T14:51:10Z")
Thanks. I created companion issue in beats: [https://github.com/elastic/beats/issues/1504](https://github.com/elastic/beats/issues/1504) ---
**Author:** ![lukyanov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukyanov/32/9667_2.png) [@lukyanov](https://discuss.elastic.co/u/lukyanov)\ **Post date:** [May 9, 2016, 6:05am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/12 "2016-05-09T06:05:45Z")
Can't make SSL work. Tried everything I could imagine. Please help 🙂 The key and certificate were generated by this command: > openssl req -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout logstash-filebeat.key -out logstash-filebeat.crt /etc/logstash/conf.d/01-beats-input.conf: ``` input { beats { port => 5044 ssl => true ssl_certificate => "/etc/pki/logstash/logstash-filebeat.crt" ssl_key => "/etc/pki/logstash/logstash-filebeat.key" } } ``` /etc/filebeat/filebeat.yml: ``` logstash: hosts: ["logstash.example.com:5044"] tls: certificate_authorities: ["/etc/pki/filebeat/logstash-filebeat.crt"] ``` Getting the following in the filebeat log: > 2016-05-09T05:57:53Z DBG connect > 2016-05-09T05:57:54Z ERR SSL client failed to connect with: EOF > 2016-05-09T05:57:54Z INFO Connecting error publishing events (retrying): EOF > 2016-05-09T05:57:54Z INFO send fail > 2016-05-09T05:57:54Z INFO backoff retry: 1m0s In /var/log/messages: > May 9 06:02:56 build0 /usr/bin/filebeat[7135]: transport.go:125: SSL client failed to connect with: EOF > May 9 06:02:56 build0 /usr/bin/filebeat[7135]: single.go:126: Connecting error publishing events (retrying): EOF > May 9 06:02:56 build0 /usr/bin/filebeat[7135]: single.go:152: send fail > May 9 06:02:56 build0 /usr/bin/filebeat[7135]: single.go:159: backoff retry: 1m0s Can't find anything related in logstash log. When I disable SSL (commenting out 'tls' section in filebeat.yml and changing 'ssl' to 'false' in 01-beats-input.conf) everything works. Running on CentOS 7. > $ filebeat --version > filebeat version 1.2.2 (amd64) > $ /opt/logstash/bin/logstash --version > logstash 2.3.2 > $ /opt/logstash/bin/logstash-plugin list --installed --verbose > ... > logstash-input-beats (2.2.8) > ... ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [May 9, 2016, 10:21am UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/13 "2016-05-09T10:21:35Z")
@lukyanov please check out [https://gist.github.com/andrewkroh/fdc7e5f3f0f0ed63a11c](https://gist.github.com/andrewkroh/fdc7e5f3f0f0ed63a11c) ---
**Author:** ![dickepa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dickepa/32/8069_2.png) [@dickepa](https://discuss.elastic.co/u/dickepa)\ **Post date:** [May 12, 2016, 5:00pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/14 "2016-05-12T17:00:44Z")
How did you copy the file to the client? This can sometimes cause an issue. ELK Server > scp /etc/pki/tls/certs/logstash-forwarder.crt user@client\_server\_private\_address:/tmp Client (obviously you will not need to make a directory but thought I'd mention for others) > sudo mkdir -p /etc/pki/tls/certs > sudo cp /tmp/logstash-forwarder.crt /etc/pki/tls/certs/ I've had quite a few issues with certs. Might be worth using Windows to look at the cert to check the dns name if that's what you used to generate. eg. Mine had a "+" character in it that was quite unhelpful. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/transport-go-125-err-ssl-client-failed-to-connect-with-eof/35272/15 "2017-07-05T21:52:04Z")