# X509: cannot validate certificate for 192.168.129.33 because it doesn't contain any IP SANs
**URL:** https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435
**Category:** Beats
**Tags:** filebeat
**Created:** [August 26, 2017, 5:17am UTC](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435 "2017-08-26T05:17:42Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@igormarqs](https://discuss.elastic.co/u/igormarqs)
#### Post date: [August 26, 2017, 5:17am UTC](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435/1 "2017-08-26T05:17:42Z")
i'm try to start setup ssl btw filebeat and logstash. generate cert.pem and key.pem with:
`openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout logstashK.pem -out logstashC.pem && openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout filebeat03K.pem -out filebeat03C.pem`
copy logstash keys to /etc/logstash and filbeat to /etc/filebeat
edit pipeline.conf:
```
beats {
port => 63301
ssl => true
ssl_certificate_authorities => ["/etc/logstash/ca.crt"]
ssl_certificate => "/etc/logstash/logstashC.pem"
ssl_key => "/etc/logstash/logstashK.pem"
ssl_verify_mode => "none"<
```
and filebeat.yml
```
output.logstash:
hosts: ["192.168.129.33:63301"]
ssl.certificate_authorities: ["/etc/filebeat/ca.crt"]
ssl.certificate: "/etc/filebeat/filebeat03C.pem"
ssl.key: "/etc/filebeat/filebeat03K.pem"
verification_mode: none
```
then i run:
```
[reversal@rv03prd keys]$ curl -v --cacert ca.crt https://192.168.129.33:63001
* Rebuilt URL to: https://192.168.129.33:63001/
* Trying 192.168.129.33...
* TCP_NODELAY set
* Connected to 192.168.129.33 (192.168.129.33) port 63001 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: ca.crt
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* stopped the pause stream!
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
```
restart filebeat and logstash: `tail -f` both logs and then i have in filbeat log:
> x509: cannot validate certificate for 192.168.129.33 because it doesn't contain any IP SANs
i found this [https://serverfault.com/questions/611120/failed-tls-handshake-does-not-contain-any-ip-sans](https://serverfault.com/questions/611120/failed-tls-handshake-does-not-contain-any-ip-sans)
```
SSL needs identification of the peer, otherwise your connection might be against a man-in-the-middle which decrypts + sniffs/modifies the data and then forwards them encrypted again to the real target. Identification is done with x509 certificates which need to be validated against a trusted CA and which need to identify the target you want to connect to.
Usually the target is given as a hostname and this is checked against the subject and subject alternative names of the certificate. In this case your target is a IP. The validate the certifcate successfully the IP must be given n the certificate inside the subject alternative names section, but not as an DNS entry (e.g. hostname) but instead as IP.
So what you need to is:
Edit your /etc/ssl/openssl.cnf on the logstash host - add subjectAltName = IP:192.168.2.107 in [v3_ca] section.
Recreate the certificate
Copy the cert and key to both hosts
```
i followed those steps but still receive the same error after restart filebeat:
> x509: cannot validate certificate for 192.168.129.33 because it doesn't contain any IP SANs
and `curl -v --cacert ca.crt https://192.168.129.33:63001` have the same error.
how can i fix it? i appreciate any help.
thanks
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [August 26, 2017, 4:17pm UTC](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435/2 "2017-08-26T16:17:34Z")
Please read through the [Securing Communication With Logstash by Using SSL](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html) documentation and see the troubleshooting documentation that it links to.
> [@igormarqs](#):
>
> x509: cannot validate certificate for 192.168.129.33 because it doesn’t contain any IP SANs
It sounds like the server certificate used by Logstash still does not include the server's IP address as a SAN. I recommend opening the certificate with openssl and verifying its contents.
```auto
$ openssl x509 -text -noout -in /etc/logstash/logstashC.pem
...
X509v3 Subject Alternative Name:
IP Address:192.168.55.88
```
Alternatively you could use the FQDN that is in the server's certificate in your Filebeat config for the `output.logstash.hosts` value (provided that the FQDN is resolvable).
---
### Author:  [@igormarqs](https://discuss.elastic.co/u/igormarqs)
#### Post date: [September 1, 2017, 8:42am UTC](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435/3 "2017-09-01T08:42:53Z")
your are correct. and some steps more to generate keys and crt properly. thanks. working now.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 16, 2017, 5:17am UTC](https://discuss.elastic.co/t/x509-cannot-validate-certificate-for-192-168-129-33-because-it-doesnt-contain-any-ip-sans/98435/4 "2017-09-16T05:17:53Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.