# Adding Fleet Server failed because “x509: certificate signed by unknown authority“ **URL:** \ **Category:** SIEM\ **Tags:** fleet\ **Created:** [January 13, 2023, 8:17pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157 "2023-01-13T20:17:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [January 13, 2023, 8:17pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/1 "2023-01-13T20:17:12Z")
Hello, I tried to add a fleet server today on a CentOS Server. Because I don’t want to add Agents with the `—insecure` flag anymore, I followed this documentation step by step: > **[Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent...](https://www.elastic.co/guide/en/fleet/8.5/secure-connections.html)** I created the `ca.crt` that signed the `fleet-server.crt` and `fleet-server.key` certs using elasticsearch-certutil, copied them to the servers `/root/` directory and then executed the following command: `sudo ./elastic-agent install --fleet-server-es=https://10.20.1.6:9200 --fleet-server-service-token=AAEAAWVsYXN0a….WZmVVdnV3QQ --fleet-server-policy=5fe7bce0-b…460-779741d07fee --fleet-server-es-ca-trusted-fingerprint=809ef51507f1c26f788ff3…49dc11ef2bbbbaf96dd592d724 --certificate-authorities=/root/ca.crt --fleet-server-cert=/root/fleet-server.crt --fleet-server-cert-key=/root/fleet-server.key --url=https://fleet.mydomain.com:8220` But as response I got: `Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority` As far as I know I should get that error when enrolling a new agent to a fleet server which has no verifiable cert chain, but in this case I want to install the secure fleet server in the first place. So why I got this error? Am I overseeing something? ---
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [January 17, 2023, 11:45am UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/2 "2023-01-17T11:45:05Z")
Has no one an idea why this happens? ---
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [January 27, 2023, 8:45pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/3 "2023-01-27T20:45:51Z")
Push ---
**Author:** ![yak990](https://avatars.discourse-cdn.com/v4/letter/y/c68b51/32.png) [@yak990](https://discuss.elastic.co/u/yak990)\ **Post date:** [January 27, 2023, 9:27pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/4 "2023-01-27T21:27:10Z")
The client you are running the installer on also has to trust that certificate, I believe. ---
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [January 27, 2023, 9:48pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/5 "2023-01-27T21:48:27Z")
But I gave it the certificate to use in the first place? I don’t understand. ---
**Author:** ![Cristina\_Amico](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@Cristina\_Amico](https://discuss.elastic.co/u/Cristina_Amico)\ **Post date:** [January 30, 2023, 2:52pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/6 "2023-01-30T14:52:52Z")
Hi @maof97, > As far as I know I should get that error when enrolling a new agent to a fleet server which has no verifiable cert chain, but in this case I want to install the secure fleet server in the first place. In this specific case I think that there is some issue in the configuration that prevents authorising your certificate. Looking at the command used to enroll the fleet server ```auto sudo ./elastic-agent install \ --url=https://fleet.mydomain.com:8220 \ --fleet-server-es=https://10.20.1.6:9200 \ --fleet-server-service-token=AAEAAWVsYXN0a….WZmVVdnV3QQ \ --fleet-server-policy=5fe7bce0-b…460-779741d07fee \ --certificate-authorities=/root/ca.crt \ --fleet-server-es-ca-trusted-fingerprint=809ef51507f1c26f788ff3…49dc11ef2bbbbaf96dd592d724 \ --fleet-server-cert=/root/fleet-server.crt \ --fleet-server-cert-key=/root/fleet-server.key ``` I notice that you are using `--fleet-server-es-ca-trusted-fingerprint` instead of `--fleet-server-es-ca`. Did you follow the steps detailed [here](https://www.elastic.co/guide/en/elasticsearch/reference/8.5/configuring-stack-security.html#_use_the_ca_fingerprint_5) to configure the CA fingerprint? It can also be configured from Fleet UI by configuring `ssl.certificate_authorities: ["/path/to/your/elasticsearch-ca.crt"] ` in the Elasticsearch output YAML configuration, as explained [in this page](https://www.elastic.co/guide/en/fleet/8.5/secure-connections.html) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 27, 2023, 2:53pm UTC](https://discuss.elastic.co/t/adding-fleet-server-failed-because-x509-certificate-signed-by-unknown-authority/323157/7 "2023-02-27T14:53:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.