# Winlogbeat SSL Server auth only
**URL:** https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066
**Category:** Beats
**Tags:** winlogbeat
**Created:** [February 15, 2018, 8:31pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066 "2018-02-15T20:31:26Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@albbapm](https://discuss.elastic.co/u/albbapm)
#### Post date: [February 15, 2018, 8:31pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066/1 "2018-02-15T20:31:26Z")
I have successfully implemented mutual authentication between winlogbeat and logstash. However, due to the logistics of exporting certificates to all windows machines that will be sending logs, I would like to set up server authentication only. I have removed ssl\_verify\_mode from the server and removed the client certificates from winlogbeat but the server is rejecting the connection with the error "Peer did not return a certificate." Is there something more I need to do?
Server setup:
> ```
> beats {
> port => 5045
> type => "wineventlog"
> ssl => true
> ssl_certificate_authorities => ["/etc/logstash/rootca.cer", "/etc/logstash/SubordinateCA.cer"]
> ssl_certificate => "/etc/certs/vplogstashcert.pem"
> ssl_key => "/etc/certs/vplogstashkey.pem"
> }
>
> ```
Client Setup:
```
output.logstash:
hosts: ["servername.domain.com:5045"]
ssl.enabled: true
ssl.verification_mode: full
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [February 15, 2018, 8:43pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066/2 "2018-02-15T20:43:19Z")
Try removing `ssl_certificate_authorities` from Logstash. That setting is only has meaning when verifying client certificates.
---
### Author:  [@albbapm](https://discuss.elastic.co/u/albbapm)
#### Post date: [February 15, 2018, 9:00pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066/3 "2018-02-15T21:00:33Z")
That's it! Thank you!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 15, 2018, 9:00pm UTC](https://discuss.elastic.co/t/winlogbeat-ssl-server-auth-only/120066/4 "2018-03-15T21:00:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.