# Docker elastic-agent certificate signed by unknown authority

**URL:** <https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024>\
**Category:** Elastic Agent\
**Created:** [August 26, 2022, 2:36pm UTC](https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024 "2022-08-26T14:36:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![orihomie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orihomie/32/110122_2.png) [@orihomie](https://discuss.elastic.co/u/orihomie)\
**Post date:** [August 26, 2022, 2:36pm UTC](https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024/1 "2022-08-26T14:36:02Z")

</div>

Hi. I'm trying to launch elastic-agent in a docker-compose way:

```auto
elastic-agent:
    platform: linux/arm64
    image: docker.elastic.co/beats/elastic-agent:8.2.3
    container_name: elastic-agent
    restart: always
    user: root # note, synthetic browser monitors require this set to `elastic-agent`
    environment:
      - FLEET_ENROLLMENT_TOKEN={{ enrollment_token }} 
      - FLEET_ENROLL=1
      - FLEET_URL={{ elk_url }} 
      - FLEET_INSECURE=1
      - CERTIFICATE_AUTHORITIES={{ cert_path }}/http_ca.crt
    volumes:
      - ./elastic-agent/certs:{{ cert_path }}
      - /var/run/docker.sock:/var/run/docker.sock

```

When I do `docker-compose up` I'm getting this:

> elastic-agent | Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority

However I was able to:

1. exec into container and do

> elastic-agent enroll -f --url=$FLEET\_URL --enrollment-token=$FLEET\_ENROLLMENT\_TOKEN --certificate-authorities=$CERTIFICATE\_AUTHORITIES

```auto
{"log.level":"info","@timestamp":"2022-08-26T14:15:37.265Z","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":461},"message":"Starting enrollment to URL: {{ elk_url }} ","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-08-26T14:15:50.454Z","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":259},"message":"Elastic Agent might not be running; unable to trigger restart","ecs.version":"1.6.0"}
Successfully enrolled the Elastic Agent.

```

1. setup agent of same version right on a host (without docker)

> elastic-agent install -f --url={{ elk\_url }} --enrollment-token={{ enrollment\_token }} --certificate-authorities={{ cert\_path }}

How do I set up docker-compose elastic-agent to successfully enroll in fleet?

---

<div class="post-metadata">

**Author:** ![orihomie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/orihomie/32/110122_2.png) [@orihomie](https://discuss.elastic.co/u/orihomie)\
**Post date:** [August 29, 2022, 6:09am UTC](https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024/2 "2022-08-29T06:09:57Z")

</div>

Okay, I've figured it out after diggin into container entrypoint.  
An agent is launched by command

> elastic-agent container "$@"

And this command has no argument called "CERTIFICATE\_AUTHORITIES". Instead you should use "FLEET\_CA" variable set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2022, 6:10am UTC](https://discuss.elastic.co/t/docker-elastic-agent-certificate-signed-by-unknown-authority/313024/3 "2022-09-26T06:10:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.