# Using Fingerprint on metricbeat

**URL:** <https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [July 29, 2023, 12:36am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584 "2023-07-29T00:36:18Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [July 29, 2023, 12:36am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/1 "2023-07-29T00:36:18Z")

</div>

Hi there

i'm trying to send data using metricbeat here v8.8.2 and i'm trying to use fingerprint as replacement of _certificate\_authorities_ but i got an error like this

```auto
{"log.level":"warn","@timestamp":"2023-07-29T07:26:38.637+0700","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":186},"message":"no CA certificate matching the fingerprint","service.name":"metricbeat","ecs.version":"1.6.0"}

```

and here is my config:

```auto
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://192.168.11.15:9200"]
  ssl:
# enabled: true
    ca_trusted_fingerprint: '0FF09F03EEB7985D0DD95E6A450251F395958AA425F6CB2A1EC6EE39C5FDBADB'
# ssl.certificate_authorities: ["/etc/metricbeat/ca.crt"]

```

i'm sure that the fingerprint is generated from the right CA certificate. but i really don't know why i can't use this fingerprint to send data to elastic. did i miss something?

```auto
[root@local certs]# openssl x509 -fingerprint -sha256 -noout -in /elastic/elasticsearch-8.8.2/config/certs/ca.crt | awk --field-separator="=" '{print $2}' | sed 's/://g'  
0FF09F03EEB7985D0DD95E6A450251F395958AA425F6CB2A1EC6EE39C5FDBADB
[root@local certs]# openssl x509 -fingerprint -sha256 -noout -in /etc/metricbeat/ca.crt | awk --field-separator="=" '{print $2}' | sed 's/://g'
0FF09F03EEB7985D0DD95E6A450251F395958AA425F6CB2A1EC6EE39C5FDBADB

```

please help. Thanks

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 29, 2023, 1:57am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/2 "2023-07-29T01:57:48Z")

</div>

Did metricbeat connect when you used actual ca.crt?

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [July 29, 2023, 4:30am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/3 "2023-07-29T04:30:43Z")

</div>

Yes, that is so weird. If i define certificate\_authorities, the connection to elastic was established but that's not happen when i try to use ca\_trusted\_fingerprint

Pada tanggal Sab, 29 Jul 2023 09.07, Stephen Brown via Discuss the Elastic Stack \<[notifications@elastic.discoursemail.com](mailto:notifications@elastic.discoursemail.com)\> menulis:

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [July 29, 2023, 4:55am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/4 "2023-07-29T04:55:52Z")

</div>

try running

`metricbeat test output`

with both configurations... make sure you do not changes the host URL.

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 8, 2023, 2:57pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/5 "2023-08-08T14:57:04Z")

</div>

hello @stephenb sorry for the late response. here is the output with each configuration

- Using certificate

```auto
elasticsearch: https://192.168.100.227:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.100.227
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... OK
    TLS version: TLSv1.3
    dial up... OK
  talk to server... OK
  version: 8.8.2

```

- Using fingerprint

```auto
elasticsearch: https://192.168.100.227:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 192.168.100.227
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... ERROR x509: certificate signed by unknown authority

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2023, 3:20pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/6 "2023-08-08T15:20:25Z")

</div>

so when you just run

`openssl x509 -fingerprint -sha256 -in config/certs/http_ca.crt`

What is the output

also have you tried with and without the quotes? Double Quotes...

There is something simple going on...

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 8, 2023, 4:38pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/7 "2023-08-08T16:38:52Z")

</div>

> [@stephenb](#):
>
> also have you tried with and without the quotes? Double Quotes...

I already tried this but still got the same result

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 8, 2023, 4:40pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/8 "2023-08-08T16:40:08Z")

</div>

> [@stephenb](#):
>
> What is the output

here is the result:

```auto
SHA256 Fingerprint=CD:FB:71:AD:DE:C7:C0:82:31:63:DF:8E:48:08:DC:C7:1B:65:A6:22:CD:7A:A0:E8:91:B8:A2:C1:10:C7:05:EB

```

note: sorry. this is from another server for testing. the previous ca.crt and the server was destroyed. so maybe that is quite a difference but this uses the same config as my first post

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2023, 4:57pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/9 "2023-08-08T16:57:45Z")

</div>

Confused ... the fingerprint needs to come from the actual CA?

2nd did you try without the quotes?

Not sure what is going on.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2023, 5:02pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/10 "2023-08-08T17:02:04Z")

</div>

What does the issuer say

```auto
hyperion:certs sbrown$ openssl x509 -issuer -fingerprint -sha256 -noout -in ./http_ca.crt 
issuer=CN = Elasticsearch security auto-configuration HTTP CA
sha256 Fingerprint=1C:F1:FB:FD:EF:7D:26:C9:7B:4C:75:94:5A:3C:F7:94:51:FC:B7:F9:B0:4D:CF:52:BE:32:8A:C3:A0:99:4A:53

```

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 8, 2023, 5:05pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/11 "2023-08-08T17:05:04Z")

</div>

> [@stephenb](#):
>
> Confused ... the fingerprint needs to come from the actual CA?

in documentation it said from CA, right? what I'm trying to say is, I made a new server to test this. and I generated a new certificate too. so if you see some unrelated information from my recent post for example the path of the certificate or something it's expected. but I can make sure i made the same config like this

```auto
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["https://192.168.11.15:9200"]
  ssl:
# enabled: true
    ca_trusted_fingerprint: 'xxx'
# ssl.certificate_authorities: ["/etc/metricbeat/ca.crt"]

```

> [@stephenb](#):
>
> 2nd did you try without the quotes?

quotes, double quotes, I already tried those two options

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 8, 2023, 5:07pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/12 "2023-08-08T17:07:13Z")

</div>

> [@stephenb](#):
>
> What does the issuer say

here:

```auto
issuer=CN = Elastic Certificate Tool Autogenerated CA
SHA256 Fingerprint=CD:FB:71:AD:DE:C7:C0:82:31:63:DF:8E:48:08:DC:C7:1B:65:A6:22:CD:7A:A0:E8:91:B8:A2:C1:10:C7:05:EB

```

and when I followed the command documented on the documentation, it give me result that look like this:

```auto
#openssl x509 -fingerprint -sha256 -noout -in /monitoring/elasticsearch-8.8.2/config/certs/ca.crt | awk --field-separator="=" '{print $2}' | sed 's/://g'
CDFB71ADDEC7C0823163DF8E4808DCC71B65A622CD7AA0E891B8A2C110C705EB

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2023, 5:14pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/13 "2023-08-08T17:14:09Z")

</div>

Yup everything looks good not sure what to tell you...

unfortunately I don't think curl works with fingerprint that would be a good test with -v

you could set TRACE debug see if you see anything more

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2023, 5:19pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/14 "2023-08-08T17:19:54Z")

</div>

> [@yuswanul](#):
>
> `/monitoring/elasticsearch-8.8.2/config/certs/ca.crt `

shouldn't that be

`/monitoring/elasticsearch-8.8.2/config/certs/http_ca.crt`

The HTTP CA

```auto
hyperion:config sbrown$ cd certs/
http.p12 http_ca.crt transport.p12
hyperion:certs sbrown$ 

```

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 8, 2023, 5:22pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/15 "2023-08-08T17:22:01Z")

</div>

I used --pem option when generating ca.crt

```auto
./bin/elasticsearch-certutil ca --pem --days 1095 --out ca.zip

```

so I don't use truststore and keystore

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [August 8, 2023, 5:37pm UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/16 "2023-08-08T17:37:22Z")

</div>

and you are generating the certificate from that CA?

I would try the default security process first...

I just ran through the default process end to end fingerprint worked fine.

---

<div class="post-metadata">

**Author:** ![yuswanul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuswanul/32/101662_2.png) [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Post date:** [August 9, 2023, 12:16am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/17 "2023-08-09T00:16:12Z")

</div>

Yes, i generated a certificate with that CA. Hmmm does it mean fingerprint doesn't support a certificate with pem format?

Pada tanggal Rab, 9 Agu 2023 00.47, Stephen Brown via Discuss the Elastic Stack \<[notifications@elastic.discoursemail.com](mailto:notifications@elastic.discoursemail.com)\> menulis:

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 6, 2023, 2:16am UTC](https://discuss.elastic.co/t/using-fingerprint-on-metricbeat/339584/18 "2023-09-06T02:16:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.