# Valid certificate from filebeat to logstash

**URL:** <https://discuss.elastic.co/t/valid-certificate-from-filebeat-to-logstash/173690>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 25, 2019, 8:53am UTC](https://discuss.elastic.co/t/valid-certificate-from-filebeat-to-logstash/173690 "2019-03-25T08:53:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![triguer](https://avatars.discourse-cdn.com/v4/letter/t/e9c0ed/32.png) [@triguer](https://discuss.elastic.co/u/triguer)\
**Post date:** [March 25, 2019, 8:53am UTC](https://discuss.elastic.co/t/valid-certificate-from-filebeat-to-logstash/173690/1 "2019-03-25T08:53:41Z")

</div>

Hello,

I am trying to configure a tls comunication between all ELK stack. I am already configured tls between logstash - elasticsearch and elasticsearch - kibana. But when I try to configure the secure comunication between filebeats and logstash with the same certificate used before, it give me errors and does not let me configure the secure comunication.

I had two diferents errors, the first one is is the exactly same certificate used in elasticsearch and kibana comunication:

```
[2019-03-20T09:33:13,469][ERROR][logstash.inputs.beats] Looks like you either have a bad certificate, an invalid key or your private key was not in PKCS8 format.

    [2019-03-20T09:33:13,548][WARN][io.netty.channel.ChannelInitializer] Failed to initialize a channel. Closing: [id: 0xb5596e7e, L:/127.0.0.1:4088 - R:/127.0.0.1:48834]

    Caused by: java.security.spec.InvalidKeySpecException: Neither RSA, DSA nor EC worked

    Caused by: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException : algid parse error, not a sequence

    Caused by: java.security.InvalidKeyException: IOException : algid parse error, not a sequence 

```

and If I try to translate the key format to PKCS8, a new error occurred:

```
[2019-03-20T09:22:54,663][INFO][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:4088, remote: 0:0:0:0:0:0:0:1:52196] Handling exception: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE
[2019-03-20T09:22:54,664][WARN][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_201]
Caused by: javax.net.ssl.SSLHandshakeException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE
        at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.shutdownWithError(ReferenceCountedOpenSslEngine.java:876) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]
        at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.sslReadErrorResult(ReferenceCountedOpenSslEngine.java:1124) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

```

¿Which certificates I need to configure correctly the secure comunication between filebeat and logstash?

I left the configuration I used in filebeat and logstash in case I write something incorrect there:

logstash:

> input {  
> beats {  
> port =\> 5044  
> ssl =\> true  
> ssl\_certificate =\> '/elastic/config/certs/tls.crt'  
> ssl\_certificate\_authorities =\> ["/elastic/config/certs/ca.crt"]  
> #ssl\_key =\> '/elastic/config/certs/tls.p8'  
> ssl\_key =\> '/elastic/config/certs/tls.key'  
> }

filebeat:

```
# Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  ssl.certificate_authorities: ["/elastic/config/certs/ca.crt"]

  # Certificate for SSL client authentication
  ssl.certificate: "/elastic/config/certs/tls.crt"

  # Client Certificate Key
  #ssl.key: "/elastic/config/certs/tls.p8"
  ssl.key: "/elastic/config/certs/tls.key"

```

If you need anything else please let me know.

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 22, 2019, 8:53am UTC](https://discuss.elastic.co/t/valid-certificate-from-filebeat-to-logstash/173690/2 "2019-04-22T08:53:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.