Beats input stuck in "Error creating SSL context" loop

Graylog Central (peer support)
1

My Graylog 6.0 Beats input is creating a log about every four seconds like this

Summary 
2025-05-16T09:05:26.257+00:00 ERROR [AbstractTcpTransport] Error creating SSL context. Make sure the certificate and key are in the correct format: cert=X.509 key=PKCS#8
2025-05-16T09:05:26.257+00:00 WARN  [ChannelInitializer] Failed to initialize a channel. Closing: [id: 0xe68ad8ab, L:/192.168.60.1:5044 - R:/192.168.60.200:60173]
javax.net.ssl.SSLException: failed to set certificate and key
        at io.netty.handler.ssl.ReferenceCountedOpenSslServerContext.newSessionContext(ReferenceCountedOpenSslServerContext.java:141) ~[graylog.jar:?]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:359) ~[graylog.jar:?]
        at io.netty.handler.ssl.OpenSslServerContext.<init>(OpenSslServerContext.java:338) ~[graylog.jar:?]
        at io.netty.handler.ssl.SslContext.newServerContextInternal(SslContext.java:484) ~[graylog.jar:?]
        at io.netty.handler.ssl.SslContextBuilder.build(SslContextBuilder.java:643) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.createSslEngine(AbstractTcpTransport.java:377) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.call(AbstractTcpTransport.java:338) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.AbstractTcpTransport$3.call(AbstractTcpTransport.java:334) ~[graylog.jar:?]
        at org.graylog2.plugin.inputs.transports.NettyTransport$1.initChannel(NettyTransport.java:105) ~[graylog.jar:?]
        at io.netty.channel.ChannelInitializer.initChannel(ChannelInitializer.java:129) [graylog.jar:?]
        at io.netty.channel.ChannelInitializer.handlerAdded(ChannelInitializer.java:112) [graylog.jar:?]
        at io.netty.channel.AbstractChannelHandlerContext.callHandlerAdded(AbstractChannelHandlerContext.java:1130) [graylog.jar:?]
        at io.netty.channel.DefaultChannelPipeline.callHandlerAdded0(DefaultChannelPipeline.java:558) [graylog.jar:?]
        at io.netty.channel.DefaultChannelPipeline.access$100(DefaultChannelPipeline.java:45) [graylog.jar:?]
        at io.netty.channel.DefaultChannelPipeline$PendingHandlerAddedTask.execute(DefaultChannelPipeline.java:1410) [graylog.jar:?]
        at io.netty.channel.DefaultChannelPipeline.callHandlerAddedForAllHandlers(DefaultChannelPipeline.java:1064) [graylog.jar:?]
        at io.netty.channel.DefaultChannelPipeline.invokeHandlerAddedIfNeeded(DefaultChannelPipeline.java:599) [graylog.jar:?]
        at io.netty.channel.AbstractChannel$AbstractUnsafe.register0(AbstractChannel.java:513) [graylog.jar:?]
        at io.netty.channel.AbstractChannel$AbstractUnsafe.access$200(AbstractChannel.java:428) [graylog.jar:?]
        at io.netty.channel.AbstractChannel$AbstractUnsafe$1.run(AbstractChannel.java:485) [graylog.jar:?]
        at io.netty.util.concurrent.AbstractEventExecutor.runTask(AbstractEventExecutor.java:173) [graylog.jar:?]
        at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:166) [graylog.jar:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:472) [graylog.jar:?]
        at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:405) [graylog.jar:?]
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:998) [graylog.jar:?]
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:212) [graylog.jar:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
        at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
        at java.base/java.lang.Thread.run(Unknown Source) [?:?]
Caused by: java.security.KeyStoreException: Certificate chain is not valid
        at java.base/sun.security.pkcs12.PKCS12KeyStore.setKeyEntry(Unknown Source) ~[?:?]
        at java.base/sun.security.pkcs12.PKCS12KeyStore.engineSetKeyEntry(Unknown Source) ~[?:?]
        at java.base/sun.security.util.KeyStoreDelegator.engineSetKeyEntry(Unknown Source) ~[?:?]
        at java.base/java.security.KeyStore.setKeyEntry(Unknown Source) ~[?:?]
        at io.netty.handler.ssl.SslContext.buildKeyStore(SslContext.java:1158) ~[graylog.jar:?]
        at io.netty.handler.ssl.ReferenceCountedOpenSslServerContext.newSessionContext(ReferenceCountedOpenSslServerContext.java:126) ~[graylog.jar:?]
        ... 30 more

Log says its is problem with private key but private key is fine. It was working fine before I allowed new group of clients to migrate like an hour ago.

Wierdest thing is: Stopping beats input does not stop this! (wrong, stopped wrong input)

Weirdest thing is: systemctl restart graylog-server does not stop this!
But all other nodes running same input have nothing like this in log.

2

Problem is tls_cert_file on affected node was like this:

leaf cert
leaf cert
CA cert

This same file is no problem for graylog web interface (http_tls_cert_file in graylog.conf) so I expected cert file OK.