# Trying to secure Logstash **URL:** \ **Category:** Logstash\ **Created:** [October 9, 2020, 5:08pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602 "2020-10-09T17:08:22Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![thatch56](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@thatch56](https://discuss.elastic.co/u/thatch56)\ **Post date:** [October 9, 2020, 5:08pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/1 "2020-10-09T17:08:22Z")
So im trying to secure the communication to logstash in my elk stack. I have a certificate that is working for kibana so i was going to test and see if it would work with logstash. Kibana and Logstash are on the same server. ```auto beats { port => 5044 host => "servername.company.com" ssl => true ssl_certificate => "/etc/logstash/conf.d/kibana-server/kibana-server.crt" ssl_key => "/etc/logstash/conf.d/kibana-server/kibana-server.key" } } ``` If i remove the ssl part logstash opens up 5044 like it should but when i add it back i get the following in the log file ```auto Oct 09 11:04:54 logstash[242496]: [2020-10-09T11:04:54,421][INFO][logstash.javapipeline][main] Pipeline Java execution initialization time {"seconds"=>0.87} Oct 09 11:04:54 logstash[242496]: [2020-10-09T11:04:54,457][INFO][logstash.inputs.beats][main] Beats inputs: Starting input listener {:address=>"servername.company.com:5044"} Oct 09 11:04:55 logstash[242496]: [2020-10-09T11:04:55,490][ERROR][logstash.agent] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create
, action_result: false", :backtrace=>nil} Oct 09 11:04:55 logstash[242496]: [2020-10-09T11:04:55,761][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=>9600} ``` Need to get this corrected so i can put it into production. Thank you for your help. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2020, 5:49pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/2 "2020-10-09T17:49:03Z")
Enable log.level debug and you will likely get an additional message that tells you what the problem is. ---
**Author:** ![thatch56](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@thatch56](https://discuss.elastic.co/u/thatch56)\ **Post date:** [October 9, 2020, 7:12pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/3 "2020-10-09T19:12:45Z")
Looks like it does not like the key file but its the same cert and key file pair that I used for Kibana and kibana works. Im using Microsoft as the CA so do i need to do something special when creating the Cert or the CSR? ```auto `Oct 09 13:09:16 nbhh-elk logstash[265609]: [2020-10-09T13:09:16,298][DEBUG][logstash.javapipeline][main] Pipeline terminated by worker error {:pipeline_id=>"main", :exception=>java.lang.IllegalArgumentException: File does not contain valid private key: /etc/logstash/conf.d/kibana-server/kibana-server.key, :backtrace=>["io.netty.handler.ssl.SslContextBuilder.keyManager(io/netty/handler/ssl/SslConte>` ``` ---
**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\ **Post date:** [October 9, 2020, 7:27pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/4 "2020-10-09T19:27:58Z")
You might need to convert the `.key` to pkcs8 Elastic have a tutorial on how to do so: > **[Configuring SSL, TLS, and HTTPS to secure Elasticsearch, Kibana, Beats, and...](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash#enable-ts-logstash)** > > Feeling insecure about your Elastic Stack security? Run through these step-by-step instructions for setting up TLS encryption and https on Elasticsearch, Kibana, Logstash, and Beats to shore up your stack's defenses. Highly recommended for end-to-end... Hope this could help you! ---
**Author:** ![amorrow](https://avatars.discourse-cdn.com/v4/letter/a/a5b964/32.png) [@amorrow](https://discuss.elastic.co/u/amorrow)\ **Post date:** [October 9, 2020, 8:12pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/5 "2020-10-09T20:12:23Z")
I would also check to make sure the path specified is correct and check the permissions of the `.key` file. The logstash service account may not have read permissions if you copied the file directly from kibana's config folder. ---
**Author:** ![thatch56](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@thatch56](https://discuss.elastic.co/u/thatch56)\ **Post date:** [October 9, 2020, 9:11pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/6 "2020-10-09T21:11:34Z")
According to this it should at least be able to read it right? `-rw-r--r-- 1 root root 1675 Oct 9 10:46 kibana-server.key` ---
**Author:** ![thatch56](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@thatch56](https://discuss.elastic.co/u/thatch56)\ **Post date:** [October 9, 2020, 9:38pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/7 "2020-10-09T21:38:37Z")
Do I need to do anything special when creating the CSR or certificate itself? ---
**Author:** ![thatch56](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@thatch56](https://discuss.elastic.co/u/thatch56)\ **Post date:** [October 12, 2020, 5:27pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/8 "2020-10-12T17:27:16Z")
Changing the format of the key did the trick. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 9, 2020, 5:27pm UTC](https://discuss.elastic.co/t/trying-to-secure-logstash/251602/9 "2020-11-09T17:27:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.