diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba2e762a..803fe3ee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,7 @@ The **patch** part changes incrementally at each release.
 * filebeat: package can be upgraded to latest (default: False)
 * haproxy: possible admin access with login/pass
 * metricbeat: package can be upgraded to latest (default: False)
+* metricbeat: new variables to configure SSL mode
 * nagios-nrpe: new script check_phpfpm_multi
 * nginx: add access to server status on default VHost
 * postfix: add smtpd_relay_restrictions in configuration
diff --git a/metricbeat/defaults/main.yml b/metricbeat/defaults/main.yml
index 3e74556f..9529bef3 100644
--- a/metricbeat/defaults/main.yml
+++ b/metricbeat/defaults/main.yml
@@ -7,6 +7,10 @@ metricbeat_elasticsearch_protocol: ""
 metricbeat_elasticsearch_auth_api_key: ""
 metricbeat_elasticsearch_auth_username: ""
 metricbeat_elasticsearch_auth_password: ""
+metricbeat_elasticsearch_ssl: False
+metricbeat_elasticsearch_ssl_certificate_authorities: []
+metricbeat_elasticsearch_ssl_certificate: ""
+metricbeat_elasticsearch_ssl_verification_mode: ""
 
 metricbeat_processors_cloud_metadata: False
 
diff --git a/metricbeat/templates/metricbeat.default.yml.j2 b/metricbeat/templates/metricbeat.default.yml.j2
index bd88cdc6..56c348fc 100644
--- a/metricbeat/templates/metricbeat.default.yml.j2
+++ b/metricbeat/templates/metricbeat.default.yml.j2
@@ -112,6 +112,18 @@ output.elasticsearch:
 {% if metricbeat_elasticsearch_auth_password %}
   password: "{{ metricbeat_elasticsearch_auth_password }}"
 {% endif %}
+{% if metricbeat_elasticsearch_ssl %}
+  ssl.enabled: true
+{% if metricbeat_elasticsearch_ssl_certificate_authorities != [] %}
+  ssl.certificate_authorities: ["{{ metricbeat_elasticsearch_ssl_certificate_authorities | join('", "') }}"]
+{% endif %}
+{% if metricbeat_elasticsearch_ssl_certificate %}
+  ssl.certificate: "{{ metricbeat_elasticsearch_ssl_certificate }}"
+{% endif %}
+{% if metricbeat_elasticsearch_ssl_verification_mode %}
+  ssl.verification_mode: "{{ metricbeat_elasticsearch_ssl_verification_mode }}"
+{% endif %}
+{% endif %}
 
 # ------------------------------ Logstash Output -------------------------------
 #output.logstash: