Beats currently present a client certificate only to Logstash (Logstash enforces it with ssl_verify_mode => force_peer), not to Elasticsearch — so beats→ES is one-way TLS + password.
Add an opt-in that makes Beats present a client certificate on the Elasticsearch output (ssl.certificate + ssl.key), for mutual TLS. ssl.certificate_authorities (server verification) is unchanged and stays on the TLS side.
Depends on: the ES-side enabler xpack.security.http.ssl.client_authentication (see #536 — else ES ignores the cert) and the Beats TLS axis beats_tls (#528). Opt-in, default off. Part of #536. 2.0.0.
Beats currently present a client certificate only to Logstash (Logstash enforces it with
ssl_verify_mode => force_peer), not to Elasticsearch — so beats→ES is one-way TLS + password.Add an opt-in that makes Beats present a client certificate on the Elasticsearch output (
ssl.certificate+ssl.key), for mutual TLS.ssl.certificate_authorities(server verification) is unchanged and stays on the TLS side.Depends on: the ES-side enabler
xpack.security.http.ssl.client_authentication(see #536 — else ES ignores the cert) and the Beats TLS axisbeats_tls(#528). Opt-in, default off. Part of #536. 2.0.0.