# Use ssl/tls between Filebeat and Logstash problems

**URL:** <https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632>\
**Category:** Elasticsearch\
**Created:** [July 17, 2020, 11:04am UTC](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632 "2020-07-17T11:04:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 17, 2020, 11:04am UTC](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632/1 "2020-07-17T11:04:36Z")

</div>

Dears,

When I created the certs for Filebeat:

```auto
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --pem --ca-cert /etc/elasticsearch/certs/ca.crt --ca-key /etc/elasticsearch/certs/ca.key --in /tmp/filebeats.yml --out /tmp/certs/filebeats.zip

```

Then filebeat cannot connect to Logstash:

```auto
ERROR [publisher_pipeline_output] pipeline/output.go:155 Failed to connect to backoff(async(tcp://elk-node-01:5044)): dial tcp 10.0.10.11:5044: connect: connection refused

```

```auto
filebeat.yml:
output.logstash:

  hosts: ["elk-node-01:5044", "elk-node-02:5044", "elk-node-03:5044"]
  loadbalance: true

  ssl.certificate_authorities: ["/etc/filebeat/certs/ca.crt"]
  ssl.certificate: "/etc/filebeat/certs/client.crt"
  ssl.key: "/etc/filebeat/certs/client.key"

```

In Logstash configuration there are certs used for communication between ELK nodes.  
Logstash conf looks like:

```auto
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
    ssl_certificate => "/etc/logstash/certs/elk-node-01.crt"
    ssl_key => "/etc/logstash/certs/elk-node-01.key"
    ssl_verify_mode => "force_peer"
  }
}

```

Logstash show error:

```auto
elk-node-01 logstash: [2020-07-17T12:26:27,320][ERROR][logstash.javapipeline][main] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>java.lang.IllegalArgumentException: 
File does not contain valid private key: /etc/logstash/certs/elk-node-01.key, :backtrace=>["io.netty.handler.ssl.SslContextBuilder.keyManager(io/netty/handler/ssl/SslContextBuilder.java:270)", "io.netty.handler.ssl.SslContextBuilder.forServer(io/netty/handler/ssl/SslContextBuilder.java:90)", "org.logstash.netty.SslContextBuilder.buildContext(org/logstash/netty/SslContextBuilder.java:104)", "java.lang.reflect.Method.invoke(java/lang/reflect/Method.java:498)

```

Do you have any idea what is wrong?

Many Thanks.

Regards,  
Dan

---

<div class="post-metadata">

**Author:** ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Post date:** [July 17, 2020, 2:57pm UTC](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632/2 "2020-07-17T14:57:02Z")

</div>

I found the solution. The file with private key have to be converted to certificate pkcs8. It can be done by openssl tool.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2020, 2:57pm UTC](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632/3 "2020-08-14T14:57:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.