#19385·logstash

xpack management certificate works with RSA PKCS#8 - request for EC PKCS#8 support

Author: jguayCreated Aug 5, 2026Updated Sep 1, 2026

Labelsenhancementstatus:needs-triage

doc currently mentions :

`xpack.management.elasticsearch.ssl.certificate`
:   Optional setting that provides the path to an SSL certificate to use to authenticate the client. This certificate should be an OpenSSL-style X.509 certificate file.

`xpack.management.elasticsearch.ssl.key`
:   Optional setting that provides the path to an OpenSSL-style RSA private key that corresponds to the `xpack.management.elasticsearch.ssl.certificate`.

Using elasticsearch 9.4.4 certutil which uses RSA PKCS#1 fails with :

[2026-08-05T16:03:12,474][ERROR][logstash.licensechecker.licensereader] Unable to retrieve Elasticsearch cluster info. {message: "java.security.InvalidKeyException: Unable to decode key", exception: Java::JavaSecuritySpec::InvalidKeySpecException}

RSA PKCS#8 works fine so potentially documentation should specify RSA PKCS#8 instead of RSA - to match what manticore expects and make it clear RSA PKCS#1 is not supported

User reported and reproduced that EC PKCS#8 fails with Invalid RSA private key (reproducible) - workaround in https://discuss.elastic.co/t/ls-to-es-via-mtls-rsa-only/374849/2 :

sed -i -e 's/BEGIN PRIVATE/BEGIN EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key
sed -i -e 's/END PRIVATE/END EC PRIVATE/g' /usr/share/logstash/config/tls.pkcs8.key

reproduction

944cpm-xpackmanagement-rsapkcs8.zip

Example requires docker-compose (with docker having enough RAM assigned to run stack)

To reproduce :

execute ./runAll.sh this will start ES+Kibana+Logstash+metricbeat (monitoring) with centralized pipeline management using PKCS#8 which is working ok
in docker-compose.yml comment 2 lines key/certificate and uncomment another to reproduce issue with RSA PKCS#1 or EC PKCS8 in volume for logstash0:

    volumes:
      - ./config/logstash0.yml:/usr/share/logstash/config/logstash.yml
      - ./certs/ca/ca.crt:/usr/share/logstash/config/ca.crt
      # - ./certs/logstash0/logstash0.crt:/usr/share/logstash/config/logstash0.crt
      # - ./certs/logstash0/logstash0.key:/usr/share/logstash/config/logstash0.key #Unable to decode key (certutil generate RSA PKCS#1)

      # - ./certs/logstash0-RSA2048b/logstash0.crt:/usr/share/logstash/config/logstash0.crt
      # - ./certs/logstash0-RSA2048b/logstash0.key:/usr/share/logstash/config/logstash0.key # java.security.InvalidKeyException: Unable to decode key

      - ./certs/logstash0-rsapkcs8/logstash0.crt:/usr/share/logstash/config/logstash0.crt #works
      - ./certs/logstash0-rsapkcs8/logstash0.key:/usr/share/logstash/config/logstash0.key #works

      # - ./certs/logstash0-ECPKCS1/logstash0.crt:/usr/share/logstash/config/logstash0.crt
      # - ./certs/logstash0-ECPKCS1/logstash0.key:/usr/share/logstash/config/logstash0.key # java.security.InvalidKeyException: Unable to decode key

      # - ./certs/logstash0-ECPKCS8/logstash0.crt:/usr/share/logstash/config/logstash0.crt
      # - ./certs/logstash0-ECPKCS8/logstash0.key:/usr/share/logstash/config/logstash0.key # java.security.InvalidKeyException: Invalid RSA private key

      # - ./certs/logstash0-ECPKCS8-edited/logstash0.crt:/usr/share/logstash/config/logstash0.crt
      # - ./certs/logstash0-ECPKCS8-edited/logstash0.key:/usr/share/logstash/config/logstash0.key #works adding EC in header/footer of key

After each change run docker-compose up logstash - this will recreate the container because service definition changed and display the log (or docker-compose up -d logstash0 && docker-compose logs -f logstash0)

ECPKCS8-edited is a copy of ECPKCS8 where the grep workaround was applied

Source: elastic/logstash

View original on GitHub View discussion on GitHub