Disable ssl certificate validation

[robin13]

Would be good to have the same option which is available for logstash-output-elasticsearch to be able to disable ssl certificate verification:

ssl_certificate_verification: false

[jordansissel]

Please stop commenting "+1". Doing so generates tons of emails. I have deleted all the +1 comments. At the time of deletion, there were 5 +1 comments.

Related: We don't have a voting system.

[bw498c]

Original comment was in 2015. Is there an ETA for this?

[rlwmmw]

This is an absolute necessity. When using ECE, The auto-generated, self-signed certs do not match the host-name, and adding certs to a ca_file doesn't resolve this issue. A no-verify option is basic and should be included.

[ageis]

Is such an option available for the Logstash input? I've been using Easy-RSA to generate my own self-signed certs via my own CA, which I then propagate to the server and Filebeat/Metricbeat clients and I still run into lots of problems...

[rlwmmw]

I have created a working fix to disable ssl_certificate_verification by adding a new config statement and adjusting the Boolean logic for transport options.

These changes were made to this file:
'<Logstash Path>/vendor/bundle/jruby/<version>/gems/logstash-input-elasticsearch-/lib/logstash/inputs/elasticsearch.rb'

After this:
# SSL
config :ssl, :validate => :boolean, :default => false `

I added this:

# ssl_certificate_verification - Disable ssl_verification with false
config :ssl_certificate_verification, :validate => :boolean, :default => true

Then I changed this:

if @ssl && @ca_file
transport_options[:ssl] = { :ca_file => @ca_file }
end

To this:

if @ssl && !@ssl_certificate_verification
transport_options[:ssl] = { :verify => @ssl_certificate_verification }
elsif @ssl && @ca_file
transport_options[:ssl] = { :ca_file => @ca_file }
end

see attached for full working file.

WARNING: Use at your own risk!

elasticsearch.rb.txt

[rkhapre]

Hi @rlwmmw , i have replace the file above with the existing file and it is still not working
This is how my conf file looks like

I am using 5.2

input {
  elasticsearch {
    hosts => ["acd.com:9200"]
	ssl => false
	user => "xyz"
	password => "psw"
    index => "asdfg"
    size => 10
    #scroll => "5m"
    docinfo => true
  }
}

I am getting this error

docinfo_fields=>["_index", "_type", "_id"], ssl_certificate_verification=>tr
ue>
  Error: certificate verify failed
  Exception: Faraday::SSLError
  Stack: org/jruby/ext/openssl/SSLSocket.java:215:in `connect'

Let me know , how you resolved it

[tomryanx]

In case anyone else gets here looking for an answer to the question asked by @rkhapre - the code above adds a configuration option ssl_certificate_verification which defaults to true. To disable, add the following line to the elasticsearch input in logstash config:

ssl_certificate_verification => false

[turbopape]

Hello, I added this setup but still getting an error:
my conf:
output {
elasticsearch {
hosts => "https://XYZ:9200"
user => "XYZ"
password =>"XYZ"
ssl_certificate_verification => false
}
The error:
[WARN ] 2020-08-04 20:26:59.294 [Ruby-0-Thread-5: /usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.5.1-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:241] elasticsearch - Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"https://XYZ:XYZ@XYZ:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: ["https://XYZ:XYZ@XYZ:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"}

[rafzei]

@turbopape from error log above I see that you are using output plugin.
Put one more line ssl => true
and remove protocol from hosts, leave just host:ip

In case of input and missing skipping cert validation, the easy workaround is:
in elasticsearch.rb add new line:
ssl_options[:verify] = false
right after

hosts = setup_hosts
ssl_options = setup_ssl

Edit: tested with logstash-oss 7.9.0 (input plugin v4.7.0)

[turbopape]

Hey rafzei, thanks for the advice 👍 I actually disabled es https altogether :)
Will try it and get back to you thanks :)