Skip to main content

Why SSL does not work between my 2 servers? [Resolved]

I have 2 servers with Ubuntu 18.04:

  • monitoring.example.com (with ELK on a single server)
  • www.example.com (with Filebeat)

on the server ELK

Create directories to store SSL certificates

$ sudo mkdir -p /etc/elk-certs

Generate SSL Certificates

$ sudo openssl req -subj '/CN=monitoring.example.com/' -x509 -days 3650 -batch -nodes -newkey rsa:4096 -keyout /etc/elk-certs/monitoring-example-com.key -out /etc/elk-certs/monitoring-example-com.crt

Change the owner

$ sudo chown logstash /etc/elk-certs/monitoring-example-com.crt
$ sudo chown logstash /etc/elk-certs/monitoring-example-com.key

Send the SSL certificate to the client server

$ sudo scp /etc/elk-certs/monitoring-example-com.crt root@22.22.22.222:/tmp

on the server client

Create the directories to store the SSL certificate

$ sudo mkdir -p /etc/elk-certs

Copy the certificate into the directory

$ sudo mv /tmp/monitoring-example-com.crt /etc/elk-certs/

on the server ELK

Here is the configuration file /etc/logstash/conf.d/logstash.conf on the server monitoring.example.com :

input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/elk-certs/monitoring-example-com.crt"
    ssl_key => "/etc/elk-certs/monitoring-example-com.key"      
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

Restart Logstash

$ sudo systemctl restart logstash

on the server client

Here is the configuration file /etc/filebeat/filebeat.yml on the server www.example.com :

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["monitoring.example.com:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  ssl.certificate_authorities: ["/etc/elk-certs/monitoring-example-com.crt"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/elk-certs/monitoring-example-com.crt"

  # Client Certificate Key
  #ssl.key: "/etc/elk-certs/monitoring-example-com.key"

Restart Filebeat

$ sudo systemctl restart filebeat

PROBLEM

$ curl -v --cacert /etc/elk-certs/monitoring-example-com.crt https://monitoring.example.com:5044

* Rebuilt URL to: https://monitoring.example.com:5044/
*   Trying 2001:43d9:363:1000::2b16...
* TCP_NODELAY set
*   Trying 51.95.207.228...
* TCP_NODELAY set
* Connected to monitoring.example.com (51.95.207.228) port 5044 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/elk-certs/monitoring-example-com.crt
  CApath: /etc/ssl/certs
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=monitoring.example.com
*  start date: May 11 22:26:42 2019 GMT
*  expire date: May  8 22:26:42 2029 GMT
*  subjectAltName does not match monitoring.example.com
* SSL: no alternative certificate subject name matches target host name 'monitoring.example.com'
* stopped the pause stream!
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, Client hello (1):
curl: (51) SSL: no alternative certificate subject name matches target host name 'monitoring.example.com'

Currently Logstash does not receive any data from Filebeat.

https://pastebin.com/u2AL6Twh


Question Credit: tropcool
Question Reference
Asked May 16, 2019
Posted Under: Network
5 views
1 Answers

Your Answer