# AuditBeat: Kibana x509: certificate signed by unknown authority

**URL:** https://discuss.elastic.co/t/auditbeat-kibana-x509-certificate-signed-by-unknown-authority/279622
**Category:** Beats
**Tags:** elastic-stack-security, auditbeat
**Created:** [July 26, 2021, 11:48am UTC](https://discuss.elastic.co/t/auditbeat-kibana-x509-certificate-signed-by-unknown-authority/279622 "2021-07-26T11:48:42Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)
#### Post date: [July 26, 2021, 11:48am UTC](https://discuss.elastic.co/t/auditbeat-kibana-x509-certificate-signed-by-unknown-authority/279622/1 "2021-07-26T11:48:42Z")

</div>

At first I was getting an elasticsearch error when i tried to run `auditbeat setup` which was like that: `Exiting: couldn't connect to any of the configured Elasticsearch hosts. Errors: [error connecting to Elasticsearch at https://ubuntu-local.duckdns.org:9200: Get "https://myhost:9200": x509: certificate signed by unknown authority]`

So i looked up the elastic forums and found a solution. I changed my auditbeat.yml to look like this:

```auto
 output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["myhost:9200"]

  # Protocol - either `http` (default) or `https`.
  protocol: "https"
  ssl_verification_mode: "none"
  ssl.certificate_authorities: ["/apath/elasticsearch-ca.pem"]
  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "mypass"

```

PS: i have setup Https on my kibana and elastic nodes but i don't want to set up to the Beats right now.

So then when i tried to run again `auditbeat setup` i got another error, this time from kibana:  
again about `x509: certificate signed by unknown authority`

So i added the same attributes i added into the elasticsearch section of the audibeat.yml file but with no luck

Here is the kibana section:

```auto
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "https://myhost:5601"
  ssl_verification_mode: "none"
  ssl.certificate_authorities: "/apath/elasticsearch-ca.pem"
  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  #space.id:

```

Any ideas?

Thanks in advance

---

<div class="post-metadata">

### Author: ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [July 26, 2021, 12:50pm UTC](https://discuss.elastic.co/t/auditbeat-kibana-x509-certificate-signed-by-unknown-authority/279622/2 "2021-07-26T12:50:34Z")

</div>

> [@panagiss](#):
>
> `ssl_verification_mode`

This should be `ssl.verification_mode`.

---

<div class="post-metadata">

### Author: ![panagiss](https://avatars.discourse-cdn.com/v4/letter/p/f6c823/32.png) [@panagiss](https://discuss.elastic.co/u/panagiss)
#### Post date: [July 27, 2021, 7:05am UTC](https://discuss.elastic.co/t/auditbeat-kibana-x509-certificate-signed-by-unknown-authority/279622/3 "2021-07-27T07:05:10Z")

</div>

Unbelievable. Sorry for this stupid mistake. It's cause of tiredness after hours at the PC.  
Thanks.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 24, 2021, 9:05am UTC](https://discuss.elastic.co/t/auditbeat-kibana-x509-certificate-signed-by-unknown-authority/279622/4 "2021-08-24T09:05:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.