# SSL Connection Problem between Logstash and ElasticSearch with SearchGuard **URL:** \ **Category:** Search Guard\ **Created:** [December 28, 2017, 11:10pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721 "2017-12-28T23:10:09Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Andres\_Gonzalez](https://avatars.discourse-cdn.com/v4/letter/a/96bed5/32.png) [@Andres\_Gonzalez](https://forum.search-guard.com/u/Andres_Gonzalez)\ **Post date:** [December 28, 2017, 11:10pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721/1 "2017-12-28T23:10:09Z")
Hello. We are evaluating Searchguard for our Security needs. I am trying to setup SSL between Logstash and Elasticsearch, however I get an error and the connected cannot be established. I am using the default configurations provided in searchguard plugins and also generated my certificates with the Online plugin provided by SearchGuard itself. Any help would be really appreciated. - Search Guard and Elasticsearch version ES Version: 5.6.5 Search Guard Version: 5.6.5-18 Logstash Version: 5.6.5 - JVM version and operating system version: JVM: 8 OS: Windows 10 Pro 64-bit - Logstash Conf File: input { stdin { } } output { elasticsearch { ``` user => logstash ``` password =\> logstash ``` hosts => "131.101.126.39" ``` ssl =\> true ssl\_certificate\_verification =\> false } } - Elasticsearch log messages on debug level [2017-12-28T17:04:59,667][ERROR][c.f.s.h.SearchGuardHttpServerTransport] [RSY\_Ban] SSL Problem Received fatal alert: certificate\_unknown javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:?] at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source) ~[?:?] at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source) ~[?:?] at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source) ~[?:?] at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source) ~[?:?] at javax.net.ssl.SSLEngine.unwrap(Unknown Source) ~[?:1.8.0\_151] at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.13.Final.jar:4.1.13.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.13.Final.jar:4.1.13.Final] at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [December 29, 2017, 9:14pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721/2 "2017-12-29T21:14:33Z")
Can you pls. post you elasticsearch.yml? Can you access elasticsearch with a curl command like: curl -kSsvv [https://131.101.126.39:9200/](https://131.101.126.39:9200/) -u logstash:logstash > **···** > > On Friday, 29 December 2017 00:10:09 UTC+1, Andrés González wrote: > > > Hello. We are evaluating Searchguard for our Security needs. I am trying to setup SSL between Logstash and Elasticsearch, however I get an error and the connected cannot be established. I am using the default configurations provided in searchguard plugins and also generated my certificates with the Online plugin provided by SearchGuard itself. > > > > > > Any help would be really appreciated. > > > > > > - Search Guard and Elasticsearch version > > > ES Version: 5.6.5 > > > Search Guard Version: 5.6.5-18 > > > Logstash Version: 5.6.5 > > > > > > - JVM version and operating system version: > > > JVM: 8 > > > OS: Windows 10 Pro 64-bit > > > > > > - Logstash Conf File: > > > input { stdin { } } > > > > > > output { > > > elasticsearch { > > > ``` > > user => logstash > > > > ``` > > > password =\> logstash > > > ``` > > hosts => "131.101.126.39" > > > > ``` > > > ssl =\> true > > > ssl\_certificate\_verification =\> false > > > } > > > } > > > - Elasticsearch log messages on debug level > > > > > > [2017-12-28T17:04:59,667][ERROR][c.f.s.h.SearchGuardHttpServerTransport] [RSY\_Ban] SSL Problem Received fatal alert: certificate\_unknown > > > javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown > > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:?] > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source) ~[?:?] > > > at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source) ~[?:?] > > > at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source) ~[?:?] > > > at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source) ~[?:?] > > > at javax.net.ssl.SSLEngine.unwrap(Unknown Source) ~[?:1.8.0\_151] > > > at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.13.Final.jar:4.1.13.Final] > > > at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] ---
**Author:** ![Omar\_mezrag](https://avatars.discourse-cdn.com/v4/letter/o/7993a0/32.png) [@Omar\_mezrag](https://forum.search-guard.com/u/Omar_mezrag)\ **Post date:** [December 30, 2017, 1:54pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721/3 "2017-12-30T13:54:38Z")
Hi, I have the same issue, here are my curl output # curl -kSsvv [https://10.30.192.201:9200/](https://10.30.192.201:9200/) -u logstash:logstash - Trying 10.30.192.201… - Connected to 10.30.192.201 (10.30.192.201) port 9200 (#0) - found 173 certificates in /etc/ssl/certs/ca-certificates.crt - found 692 certificates in /etc/ssl/certs - ALPN, offering http/1.1 - SSL connection using TLS1.2 / ECDHE\_RSA\_AES\_128\_GCM\_SHA256 - ``` server certificate verification SKIPPED ``` - ``` server certificate status verification SKIPPED ``` - ``` common name: node-0.example.com (does not match '10.30.192.201') ``` - ``` server certificate expiration date OK ``` - ``` server certificate activation date OK ``` - ``` certificate public key: RSA ``` - ``` certificate version: #3 ``` - ``` start date: Wed, 04 May 2016 20:45:28 GMT ``` - ``` expire date: Fri, 04 May 2018 20:45:28 GMT ``` - ``` issuer: DC=com,DC=example,O=Example Com Inc.,OU=Example Com Inc. Signing CA,CN=Example Com Inc. Signing CA ``` - ``` compression: NULL ``` - ALPN, server did not agree to a protocol - Server auth using Basic with user ‘logstash’ > GET / HTTP/1.1 > Host: 10.30.192.201:9200 > Authorization: Basic bG9nc3Rhc2g6bG9nc3Rhc2g= > User-Agent: curl/7.47.0 > Accept: _/_ \< HTTP/1.1 200 OK \< content-type: application/json; charset=UTF-8 \< content-length: 434 \< { “name” : “node-1”, “cluster\_name” : “searchguard\_demo”, “cluster\_uuid” : “Mr3CNnx8TZC0Z9bCiDP9eQ”, “version” : { “number” : “6.1.0”, “build\_hash” : “c0c1ba0”, “build\_date” : “2017-12-12T12:32:54.550Z”, “build\_snapshot” : false, “lucene\_version” : “7.1.0”, “minimum\_wire\_compatibility\_version” : “5.6.0”, “minimum\_index\_compatibility\_version” : “5.0.0” }, “tagline” : “You Know, for Search” } - Connection #0 to host 10.30.192.201 left intact --------------- and here my logstash output conf output { stdout { codec =\> rubydebug } elasticsearch { hosts =\> [“[https://10.30.192.201:9200](https://10.30.192.201:9200)”,“[https://10.30.192.202:9200](https://10.30.192.202:9200)”,“[https://10.30.192.203:9200](https://10.30.192.203:9200)”] user =\> “logstash” password =\> “logstash” ssl =\> “true” ssl\_certificate\_verification =\> “false” index =\> “fortinet-%{+YYYY.MM.dd}” } } > **···** > > - > > ``` > subject: C=DE,L=Test,O=Test,OU=SSL,CN=node-0.example.com > > ``` > > On Friday, December 29, 2017 at 10:14:34 PM UTC+1, Search Guard wrote: > > > Can you pls. post you elasticsearch.yml? > > Can you access elasticsearch with a curl command like: > > > > > > curl -kSsvv [https://131.101.126.39:9200/](https://131.101.126.39:9200/) -u logstash:logstash > > > On Friday, 29 December 2017 00:10:09 UTC+1, Andrés González wrote: > > > > > Hello. We are evaluating Searchguard for our Security needs. I am trying to setup SSL between Logstash and Elasticsearch, however I get an error and the connected cannot be established. I am using the default configurations provided in searchguard plugins and also generated my certificates with the Online plugin provided by SearchGuard itself. > > > > > > > > Any help would be really appreciated. > > > > > > > > - Search Guard and Elasticsearch version > > > > ES Version: 5.6.5 > > > > Search Guard Version: 5.6.5-18 > > > > Logstash Version: 5.6.5 > > > > > > > > - JVM version and operating system version: > > > > JVM: 8 > > > > OS: Windows 10 Pro 64-bit > > > > > > > > - Logstash Conf File: > > > > input { stdin { } } > > > > > > > > output { > > > > elasticsearch { > > > > ``` > > > user => logstash > > > > > > ``` > > > > password =\> logstash > > > > ``` > > > hosts => "131.101.126.39" > > > > > > ``` > > > > ssl =\> true > > > > ssl\_certificate\_verification =\> false > > > > } > > > > } > > > > - Elasticsearch log messages on debug level > > > > > > > > [2017-12-28T17:04:59,667][ERROR][c.f.s.h.SearchGuardHttpServerTransport] [RSY\_Ban] SSL Problem Received fatal alert: certificate\_unknown > > > > javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown > > > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:?] > > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > > at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source) ~[?:?] > > > > at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source) ~[?:?] > > > > at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source) ~[?:?] > > > > at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source) ~[?:?] > > > > at javax.net.ssl.SSLEngine.unwrap(Unknown Source) ~[?:1.8.0\_151] > > > > at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.13.Final.jar:4.1.13.Final] > > > > at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [December 30, 2017, 7:51pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721/4 "2017-12-30T19:51:42Z")
you have to configure “cacert” or “truststore” on the elasticsearch output plugin in logstash.conf ssl\_certificate\_verification is only about hostname verification but not about trusting ever certificate. See also [Search Guard Documentation 404 | Security for Elasticsearch | Search Guard](http://docs.search-guard.com/latest/logstash#using-search-guard-with-logstash) > **···** > > On Saturday, 30 December 2017 14:54:39 UTC+1, Omar mézrag wrote: > > > > Can you pls. post you elasticsearch.yml? > > > Can you access elasticsearch with a curl command like: > > > > > > > > curl -kSsvv [https://131.101.126.39:9200/](https://131.101.126.39:9200/) -u logstash:logstash > > > > On Friday, 29 December 2017 00:10:09 UTC+1, Andrés González wrote: > > > > > > > Hello. We are evaluating Searchguard for our Security needs. I am trying to setup SSL between Logstash and Elasticsearch, however I get an error and the connected cannot be established. I am using the default configurations provided in searchguard plugins and also generated my certificates with the Online plugin provided by SearchGuard itself. > > > > > > > > > > Any help would be really appreciated. > > > > > > > > > > - Search Guard and Elasticsearch version > > > > > ES Version: 5.6.5 > > > > > Search Guard Version: 5.6.5-18 > > > > > Logstash Version: 5.6.5 > > > > > > > > > > - JVM version and operating system version: > > > > > JVM: 8 > > > > > OS: Windows 10 Pro 64-bit > > > > > > > > > > - Logstash Conf File: > > > > > input { stdin { } } > > > > > > > > > > output { > > > > > elasticsearch { > > > > > ``` > > > > user => logstash > > > > > > > > ``` > > > > > password =\> logstash > > > > > ``` > > > > hosts => "131.101.126.39" > > > > > > > > ``` > > > > > ssl =\> true > > > > > ssl\_certificate\_verification =\> false > > > > > } > > > > > } > > > > > - Elasticsearch log messages on debug level > > > > > > > > > > [2017-12-28T17:04:59,667][ERROR][c.f.s.h.SearchGuardHttpServerTransport] [RSY\_Ban] SSL Problem Received fatal alert: certificate\_unknown > > > > > javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown > > > > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:?] > > > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > > > at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source) ~[?:?] > > > > > at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source) ~[?:?] > > > > > at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source) ~[?:?] > > > > > at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source) ~[?:?] > > > > > at javax.net.ssl.SSLEngine.unwrap(Unknown Source) ~[?:1.8.0\_151] > > > > > at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.13.Final.jar:4.1.13.Final] > > > > > at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] > > > Hi, > > I have the same issue, > > here are my curl output > > > > # curl -kSsvv [https://10.30.192.201:9200/](https://10.30.192.201:9200/) -u logstash:logstash > > > > - Trying 10.30.192.201… > > - Connected to 10.30.192.201 (10.30.192.201) port 9200 (#0) > > - found 173 certificates in /etc/ssl/certs/ca-certificates.crt > > - found 692 certificates in /etc/ssl/certs > > - ALPN, offering http/1.1 > > - SSL connection using TLS1.2 / ECDHE\_RSA\_AES\_128\_GCM\_SHA256 > > - > > > > ``` > > server certificate verification SKIPPED > > > > ``` > > > > - > > > > ``` > > server certificate status verification SKIPPED > > > > ``` > > > > - > > > > ``` > > common name: [node-0.example.com](http://node-0.example.com) (does not match '10.30.192.201') > > > > ``` > > > > - > > > > ``` > > server certificate expiration date OK > > > > ``` > > > > - > > > > ``` > > server certificate activation date OK > > > > ``` > > > > - > > > > ``` > > certificate public key: RSA > > > > ``` > > > > - > > > > ``` > > certificate version: #3 > > > > ``` > > > > - > > > > ``` > > subject: C=DE,L=Test,O=Test,OU=SSL,CN=[node-0.example.com](http://node-0.example.com) > > > > ``` > > > > - > > > > ``` > > start date: Wed, 04 May 2016 20:45:28 GMT > > > > ``` > > > > - > > > > ``` > > expire date: Fri, 04 May 2018 20:45:28 GMT > > > > ``` > > > > - > > > > ``` > > issuer: DC=com,DC=example,O=Example Com Inc.,OU=Example Com Inc. Signing CA,CN=Example Com Inc. Signing CA > > > > ``` > > > > - > > > > ``` > > compression: NULL > > > > ``` > > > > - ALPN, server did not agree to a protocol > > - Server auth using Basic with user ‘logstash’ > > > > > GET / HTTP/1.1 > > > Host: [10.30.192.201:9200](http://10.30.192.201:9200) > > > Authorization: Basic bG9nc3Rhc2g6bG9nc3Rhc2g= > > > User-Agent: curl/7.47.0 > > > Accept: _/_ > > > > \< HTTP/1.1 200 OK > > \< content-type: application/json; charset=UTF-8 > > \< content-length: 434 > > \< > > { > > “name” : “node-1”, > > “cluster\_name” : “searchguard\_demo”, > > “cluster\_uuid” : “Mr3CNnx8TZC0Z9bCiDP9eQ”, > > “version” : { > > “number” : “6.1.0”, > > “build\_hash” : “c0c1ba0”, > > “build\_date” : “2017-12-12T12:32:54.550Z”, > > “build\_snapshot” : false, > > “lucene\_version” : “7.1.0”, > > “minimum\_wire\_compatibility\_version” : “5.6.0”, > > “minimum\_index\_compatibility\_version” : “5.0.0” > > }, > > “tagline” : “You Know, for Search” > > } > > > > - Connection #0 to host 10.30.192.201 left intact > > > > --------------- and here my logstash output conf > > output { > > stdout { > > codec =\> rubydebug > > } > > elasticsearch { > > hosts =\> [“[https://10.30.192.201:9200](https://10.30.192.201:9200)”,“[https://10.30.192.202:9200](https://10.30.192.202:9200)”,“[https://10.30.192.203:9200](https://10.30.192.203:9200)”] > > user =\> “logstash” > > password =\> “logstash” > > ssl =\> “true” > > ssl\_certificate\_verification =\> “false” > > index =\> “fortinet-%{+YYYY.MM.dd}” > > } > > } > > > > On Friday, December 29, 2017 at 10:14:34 PM UTC+1, Search Guard wrote: ---
**Author:** ![Florent\_LEPOUTRE](https://avatars.discourse-cdn.com/v4/letter/f/50afbb/32.png) [@Florent\_LEPOUTRE](https://forum.search-guard.com/u/Florent_LEPOUTRE)\ **Post date:** [March 13, 2018, 8:38pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721/5 "2018-03-13T20:38:59Z")
Hi, I have exactly the same problem as Andrés. And when I add “cacert” or “truststore” on the elasticsearch output plugin in logstash.conf, the error “SSL Problem Received fatal alert: certificate\_unknown” disappears but I have a new error that seems to indicate that Logstash is trying to communicate with Elasticsearch in HTTP instead of HTTPS. I used the online generator to generate all certificate ([TLS Certificate Generator - Search Guard](https://search-guard.com/tls-certificate-generator/)). Do you have any idea ? Regards, > **···** > > Le samedi 30 décembre 2017 20:51:42 UTC+1, Search Guard a écrit : > > > you have to configure “cacert” or “truststore” on the elasticsearch output plugin in logstash.conf > > ssl\_certificate\_verification is only about hostname verification but not about trusting ever certificate. > > > See also [http://docs.search-guard.com/latest/logstash#using-search-guard-with-logstash](http://docs.search-guard.com/latest/logstash#using-search-guard-with-logstash) > > > On Saturday, 30 December 2017 14:54:39 UTC+1, Omar mézrag wrote: > > > > > > Can you pls. post you elasticsearch.yml? > > > > Can you access elasticsearch with a curl command like: > > > > > > > > > > curl -kSsvv [https://131.101.126.39:9200/](https://131.101.126.39:9200/) -u logstash:logstash > > > > > On Friday, 29 December 2017 00:10:09 UTC+1, Andrés González wrote: > > > > > > > > > Hello. We are evaluating Searchguard for our Security needs. I am trying to setup SSL between Logstash and Elasticsearch, however I get an error and the connected cannot be established. I am using the default configurations provided in searchguard plugins and also generated my certificates with the Online plugin provided by SearchGuard itself. > > > > > > > > > > > > Any help would be really appreciated. > > > > > > > > > > > > - Search Guard and Elasticsearch version > > > > > > ES Version: 5.6.5 > > > > > > Search Guard Version: 5.6.5-18 > > > > > > Logstash Version: 5.6.5 > > > > > > > > > > > > - JVM version and operating system version: > > > > > > JVM: 8 > > > > > > OS: Windows 10 Pro 64-bit > > > > > > > > > > > > - Logstash Conf File: > > > > > > input { stdin { } } > > > > > > > > > > > > output { > > > > > > elasticsearch { > > > > > > ``` > > > > > user => logstash > > > > > > > > > > ``` > > > > > > password =\> logstash > > > > > > ``` > > > > > hosts => "131.101.126.39" > > > > > > > > > > ``` > > > > > > ssl =\> true > > > > > > ssl\_certificate\_verification =\> false > > > > > > } > > > > > > } > > > > > > - Elasticsearch log messages on debug level > > > > > > > > > > > > [2017-12-28T17:04:59,667][ERROR][c.f.s.h.SearchGuardHttpServerTransport] [RSY\_Ban] SSL Problem Received fatal alert: certificate\_unknown > > > > > > javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown > > > > > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:?] > > > > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > > > > at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > > > > > > at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source) ~[?:?] > > > > > > at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source) ~[?:?] > > > > > > at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source) ~[?:?] > > > > > > at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source) ~[?:?] > > > > > > at javax.net.ssl.SSLEngine.unwrap(Unknown Source) ~[?:1.8.0\_151] > > > > > > at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > > > > > > at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.13.Final.jar:4.1.13.Final] > > > > > > at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] > > > > Hi, > > > I have the same issue, > > > here are my curl output > > > > > > # curl -kSsvv [https://10.30.192.201:9200/](https://10.30.192.201:9200/) -u logstash:logstash > > > > > > - Trying 10.30.192.201… > > > - Connected to 10.30.192.201 (10.30.192.201) port 9200 (#0) > > > - found 173 certificates in /etc/ssl/certs/ca-certificates.crt > > > - found 692 certificates in /etc/ssl/certs > > > - ALPN, offering http/1.1 > > > - SSL connection using TLS1.2 / ECDHE\_RSA\_AES\_128\_GCM\_SHA256 > > > - > > > > > > ``` > > > server certificate verification SKIPPED > > > > > > ``` > > > > > > - > > > > > > ``` > > > server certificate status verification SKIPPED > > > > > > ``` > > > > > > - > > > > > > ``` > > > common name: [node-0.example.com](http://node-0.example.com) (does not match '10.30.192.201') > > > > > > ``` > > > > > > - > > > > > > ``` > > > server certificate expiration date OK > > > > > > ``` > > > > > > - > > > > > > ``` > > > server certificate activation date OK > > > > > > ``` > > > > > > - > > > > > > ``` > > > certificate public key: RSA > > > > > > ``` > > > > > > - > > > > > > ``` > > > certificate version: #3 > > > > > > ``` > > > > > > - > > > > > > ``` > > > subject: C=DE,L=Test,O=Test,OU=SSL,CN=[node-0.example.com](http://node-0.example.com) > > > > > > ``` > > > > > > - > > > > > > ``` > > > start date: Wed, 04 May 2016 20:45:28 GMT > > > > > > ``` > > > > > > - > > > > > > ``` > > > expire date: Fri, 04 May 2018 20:45:28 GMT > > > > > > ``` > > > > > > - > > > > > > ``` > > > issuer: DC=com,DC=example,O=Example Com Inc.,OU=Example Com Inc. Signing CA,CN=Example Com Inc. Signing CA > > > > > > ``` > > > > > > - > > > > > > ``` > > > compression: NULL > > > > > > ``` > > > > > > - ALPN, server did not agree to a protocol > > > - Server auth using Basic with user ‘logstash’ > > > > > > > GET / HTTP/1.1 > > > > Host: [10.30.192.201:9200](http://10.30.192.201:9200) > > > > Authorization: Basic bG9nc3Rhc2g6bG9nc3Rhc2g= > > > > User-Agent: curl/7.47.0 > > > > Accept: _/_ > > > > > > \< HTTP/1.1 200 OK > > > \< content-type: application/json; charset=UTF-8 > > > \< content-length: 434 > > > \< > > > { > > > “name” : “node-1”, > > > “cluster\_name” : “searchguard\_demo”, > > > “cluster\_uuid” : “Mr3CNnx8TZC0Z9bCiDP9eQ”, > > > “version” : { > > > “number” : “6.1.0”, > > > “build\_hash” : “c0c1ba0”, > > > “build\_date” : “2017-12-12T12:32:54.550Z”, > > > “build\_snapshot” : false, > > > “lucene\_version” : “7.1.0”, > > > “minimum\_wire\_compatibility\_version” : “5.6.0”, > > > “minimum\_index\_compatibility\_version” : “5.0.0” > > > }, > > > “tagline” : “You Know, for Search” > > > } > > > > > > - Connection #0 to host 10.30.192.201 left intact > > > > > > --------------- and here my logstash output conf > > > output { > > > stdout { > > > codec =\> rubydebug > > > } > > > elasticsearch { > > > hosts =\> [“[https://10.30.192.201:9200](https://10.30.192.201:9200)”,“[https://10.30.192.202:9200](https://10.30.192.202:9200)”,“[https://10.30.192.203:9200](https://10.30.192.203:9200)”] > > > user =\> “logstash” > > > password =\> “logstash” > > > ssl =\> “true” > > > ssl\_certificate\_verification =\> “false” > > > index =\> “fortinet-%{+YYYY.MM.dd}” > > > } > > > } > > > > > > On Friday, December 29, 2017 at 10:14:34 PM UTC+1, Search Guard wrote: ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 16, 2018, 2:58pm UTC](https://forum.search-guard.com/t/ssl-connection-problem-between-logstash-and-elasticsearch-with-searchguard/721/6 "2018-03-16T14:58:44Z")
[https://groups.google.com/forum/#!searchin/search-guard/ssl\_certificate\_verification|sort:date/search-guard/3jBVTin7ymY/EreVEMG7CAAJ](https://groups.google.com/forum/#!searchin/search-guard/ssl_certificate_verification%7Csort:date/search-guard/3jBVTin7ymY/EreVEMG7CAAJ) you have to configure "cacert" or "truststore" on the elasticsearch output plugin in logstash.conf ssl\_certificate\_verification is only about hostname verification but not about trusting ever certificate. See also [Search Guard Documentation 404 | Security for Elasticsearch | Search Guard](http://docs.search-guard.com/latest/logstash#using-search-guard-with-logstash) > **···** > > > Am 13.03.2018 um 21:38 schrieb Florent LEPOUTRE \: > > > > Hi, > > I have exactly the same problem as Andrés. > > And when I add "cacert" or "truststore" on the elasticsearch output plugin in logstash.conf, the error "SSL Problem Received fatal alert: certificate\_unknown" disappears but I have a new error that seems to indicate that Logstash is trying to communicate with Elasticsearch in HTTP instead of HTTPS. > > I used the online generator to generate all certificate ([https://search-guard.com/tls-certificate-generator/\](https://search-guard.com/tls-certificate-generator/%5C)). > > Do you have any idea ? > > > > Regards, > > > > Le samedi 30 décembre 2017 20:51:42 UTC+1, Search Guard a écrit : > > you have to configure "cacert" or "truststore" on the elasticsearch output plugin in logstash.conf > > ssl\_certificate\_verification is only about hostname verification but not about trusting ever certificate. > > See also [Search Guard Documentation 404 | Security for Elasticsearch | Search Guard](http://docs.search-guard.com/latest/logstash#using-search-guard-with-logstash) > > > > On Saturday, 30 December 2017 14:54:39 UTC+1, Omar mézrag wrote: > > Hi, > > I have the same issue, > > here are my curl output > > > > # curl -kSsvv [https://10.30.192.201:9200/](https://10.30.192.201:9200/) -u logstash:logstash > > \* Trying 10.30.192.201... > > \* Connected to 10.30.192.201 (10.30.192.201) port 9200 (#0) > > \* found 173 certificates in /etc/ssl/certs/ca-certificates.crt > > \* found 692 certificates in /etc/ssl/certs > > \* ALPN, offering http/1.1 > > \* SSL connection using TLS1.2 / ECDHE\_RSA\_AES\_128\_GCM\_SHA256 > > \* server certificate verification SKIPPED > > \* server certificate status verification SKIPPED > > \* common name: node-0.example.com (does not match '10.30.192.201') > > \* server certificate expiration date OK > > \* server certificate activation date OK > > \* certificate public key: RSA > > \* certificate version: #3 > > \* subject: C=DE,L=Test,O=Test,OU=SSL,CN=node-0.example.com > > \* start date: Wed, 04 May 2016 20:45:28 GMT > > \* expire date: Fri, 04 May 2018 20:45:28 GMT > > \* issuer: DC=com,DC=example,O=Example Com Inc.,OU=Example Com Inc. Signing CA,CN=Example Com Inc. Signing CA > > \* compression: NULL > > \* ALPN, server did not agree to a protocol > > \* Server auth using Basic with user 'logstash' > > \> GET / HTTP/1.1 > > \> Host: 10.30.192.201:9200 > > \> Authorization: Basic bG9nc3Rhc2g6bG9nc3Rhc2g= > > \> User-Agent: curl/7.47.0 > > \> Accept: \*/\* > > \> > > \< HTTP/1.1 200 OK > > \< content-type: application/json; charset=UTF-8 > > \< content-length: 434 > > \< > > { > >   "name" : "node-1", > >   "cluster\_name" : "searchguard\_demo", > >   "cluster\_uuid" : "Mr3CNnx8TZC0Z9bCiDP9eQ", > >   "version" : { > >     "number" : "6.1.0", > >     "build\_hash" : "c0c1ba0", > >     "build\_date" : "2017-12-12T12:32:54.550Z", > >     "build\_snapshot" : false, > >     "lucene\_version" : "7.1.0", > >     "minimum\_wire\_compatibility\_version" : "5.6.0", > >     "minimum\_index\_compatibility\_version" : "5.0.0" > >   }, > >   "tagline" : "You Know, for Search" > > } > > \* Connection #0 to host 10.30.192.201 left intact > > > > --------------- and here my logstash output conf > > output { > >     stdout { > >         codec =\> rubydebug > >     } > >     elasticsearch { > >         hosts =\> ["[https://10.30.192.201:9200](https://10.30.192.201:9200)",“[https://10.30.192.202:9200](https://10.30.192.202:9200)”,"[https://10.30.192.203:9200](https://10.30.192.203:9200)"] > >         user =\> "logstash" > >         password =\> "logstash" > >         ssl =\> "true" > >         ssl\_certificate\_verification =\> "false" > >         index =\> "fortinet-%{+YYYY.MM.dd}" > >     } > > } > > > > On Friday, December 29, 2017 at 10:14:34 PM UTC+1, Search Guard wrote: > > Can you pls. post you elasticsearch.yml? > > Can you access elasticsearch with a curl command like: > > > > curl -kSsvv [https://131.101.126.39:9200/](https://131.101.126.39:9200/) -u logstash:logstash > > > > On Friday, 29 December 2017 00:10:09 UTC+1, Andrés González wrote: > > Hello. We are evaluating Searchguard for our Security needs. I am trying to setup SSL between Logstash and Elasticsearch, however I get an error and the connected cannot be established. I am using the default configurations provided in searchguard plugins and also generated my certificates with the Online plugin provided by SearchGuard itself. > > > > Any help would be really appreciated. > > > > \* Search Guard and Elasticsearch version > >       ES Version: 5.6.5 > >       Search Guard Version: 5.6.5-18 > >       Logstash Version: 5.6.5 > > > > \* JVM version and operating system version: > >      JVM: 8 > >      OS: Windows 10 Pro 64-bit > > > > \* Logstash Conf File: > >     input { stdin { } } > > > >     output { > >         elasticsearch { > >          user =\> logstash > >                password =\> logstash > >          hosts =\> "131.101.126.39" > >               ssl =\> true > >               ssl\_certificate\_verification =\> false > >         } > >      } > >        > > \* Elasticsearch log messages on debug level > > > > [2017-12-28T17:04:59,667][ERROR][c.f.s.h.SearchGuardHttpServerTransport] [RSY\_Ban] SSL Problem Received fatal alert: certificate\_unknown > > javax.net.ssl.SSLException: Received fatal alert: certificate\_unknown > >         at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[?:?] > >         at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > >         at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) ~[?:?] > >         at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source) ~[?:?] > >         at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source) ~[?:?] > >         at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source) ~[?:?] > >         at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source) ~[?:?] > >         at javax.net.ssl.SSLEngine.unwrap(Unknown Source) ~[?:1.8.0\_151] > >         at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:255) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1162) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1084) ~[netty-handler-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:926) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:644) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:544) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:498) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:458) [netty-transport-4.1.13.Final.jar:4.1.13.Final] > >         at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.13.Final.jar:4.1.13.Final] > >         at java.lang.Thread.run(Unknown Source) [?:1.8.0\_151] > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/738e502b-21af-40a8-ad3e-d98b06499bf5%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/738e502b-21af-40a8-ad3e-d98b06499bf5%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).