Failing TLS handshakes should be logged

[klaernie]

I recently spent quite some time figuring out why filebeat would not connect the logstash output to a tls-secured logstash server.
After quite some head scratching I only ever got log messages that reported the connection being reset, never any concrete issue.
A colleague then made my try disabling TLS verification (ssl.verification_mode: "none") and to my surprise it worked.
Later I found out that the default path to the ca-bundle set during the build of the rpm version does not exist on my server and I needed to set it manually.

I would have found it tremendously helpful if filebeat would have announced that it could not make the connection since it could not verify the certificate of the logstash server.
Could this be wired in, please?

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[klaernie]

Yes, still relevant.

[pierrehilbert]

Hello @klaernie sorry for the response delay.
I add this to our backlog to keep track of it.

[klaernie]

@pierrehilbert no worries, it's a gotcha, not a showstopper ;)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!