# Elastic agent needs elasticseach ca from elastic cloud **URL:** \ **Category:** Elastic Agent\ **Created:** [November 29, 2023, 7:47pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273 "2023-11-29T19:47:25Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [November 29, 2023, 7:47pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/1 "2023-11-29T19:47:25Z")
Hi there, currently I am a bit confused with the installation of fleet and elastic-agent. I am using the elastic cloud for elasticsearch, kibana and fleet. On my testserver, debian 10, we are behind a proxy. I have exported the env vars and tested with curl to get some endpoints. ```auto curl -XGET "https://.es.eu-west-1.aws.found.io/_cluster/health" -u curl -XGET "https://.kb.eu-west-1.aws.found.io/api/spaces/space" -u curl -XGET "https://.kb.eu-west-1.aws.found.io/api/fleet/agent_policies" -u ``` All of them worked so I think the connection is working as it should. Now the when adding just an agent with fleet server on elastic cloud I use the installation for linux 64. ```auto sudo ./elastic-agent install --url=https://.fleet.eu-west-1.aws.found.io:443 --enrollment-token= ``` Kibana acknowledged that there is a new agent. But the Agent did not get the policy yet. I added the Proxy settings to the systemd file. Then I restarted the agent and got: ```auto * requester 0/1 to host https://.fleet.eu-west-1.aws.found.io:443/ errored: Get "https://.fleet.eu-west-1.aws.found.io:443/api/status?": x509: certificate signed by unknown authority ``` I have 2 questions for this: 1. why it uses the "\" in the url instead of my previous url with "\" 2. And why does the cert from the fleet server is signed by an unknown authority? Maybe someone can explain this to me, I would appreciate it. Kind regards Malte ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 29, 2023, 10:55pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/2 "2023-11-29T22:55:13Z")
> [@logger](#): > > Then I restarted the agent and got: > > ```auto > * requester 0/1 to host https://.fleet.eu-west-1.aws.found.io:443/ errored: Get "https://.fleet.eu-west-1.aws.found.io:443/api/status?": x509: certificate signed by unknown authority > > ``` > > I have 2 questions for this: > > 1. why it uses the "" in the url instead of my previous url with "" > 2. And why does the cert from the fleet server is signed by an unknown authority? 1. That is just the deployment id that resolved to your deployment. In actuality behind the scene your `` gets resolved to that deployment id, the use friendly is just really an alias. 2. I am a little unclear on your architecture but did you read this > **[Fleet managed Elastic Agent connectivity using a proxy server | Fleet and...](https://www.elastic.co/guide/en/fleet/current/fleet-agent-proxy-managed.html)** There are specific instructions for using a proxy... include CLI parameters etc ---
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [December 1, 2023, 3:22pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/3 "2023-12-01T15:22:53Z")
Hi Stephen, thanks for your answer. I think I found the problem. Since I exported the proxy urls and tested all connections via curl, I thought it would work. It looks like when installing the elastic-agent as fleet you need to add `--proxy-url ` because the command line wont use the exported settings. After that the fleet server is installed correctly. May I ask another question or should I open a new thread? Question: Does the agent need a direct connection to the elastic-cloud when using a logstash as output? Context: We dont want to open the proxy/firewall that every client has a connection to elastic-cloud. All should be send via a "relais-server" as a single point in the internal network. And then the logstashes will send the whole data to the elastic cloud. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 1, 2023, 4:55pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/4 "2023-12-01T16:55:27Z")
> [@logger](#): > > Question: Does the agent need a direct connection to the elastic-cloud when using a logstash as output? > > Context: We dont want to open the proxy/firewall that every client has a connection to elastic-cloud. All should be send via a "relais-server" as a single point in the internal network. And then the logstashes will send the whole data to the elastic cloud. There are 2 paths of communication. The Data Path (Many Agents -\> Output / Logstash -\> Elasticsearch ) The Control Path (Many Agents -\> Proxy -\> Fleet) I think you are asking can this communication path can be via a proxy I think the answer is yes, > **[Using a proxy server with Elastic Agent and Fleet | Fleet and Elastic Agent...](https://www.elastic.co/guide/en/fleet/current/fleet-agent-proxy-support.html)** I have not personally set that up with the proxy. Not sure if that is what you are asking... I have set up the Many Agents -\> Output / Logstash -\> Elasticsearch Architecture that works just fine you just need to follow the instructions very very closely especially all the self signed certs and setting up logstash SSL pipelines etc ---
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [December 1, 2023, 7:20pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/5 "2023-12-01T19:20:14Z")
Hi Stephen, thanks for the quick answer. Our setup is ```auto local network ( multiple elastic-agents) -> relais-server (fleet and logstash) -> proxy -> elastic cloud ``` The best for us would be that only our `relais-server` would get access to ealstic-cloud. That when rollout some new elastic-agents we would like to have only access to the fleet-server (LAN) and logstash (LAN) But many thanks. I will try set up all of it. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [December 1, 2023, 7:28pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/6 "2023-12-01T19:28:35Z")
> [@logger](#): > > `relais-server (fleet and logstash) ` Ahhh so your fleet is local... then Yes... I think the Agents will talk to the local Fleet... Fleet will need to talk to Elasticsearch though Back to the Diagram... on this page keep that in mind > **[Deploy on-premises and self-managed | Fleet and Elastic Agent Guide \[8.11\] |...](https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html)** In your case the Data and Monitoring can go through Logstash... I am pretty sure ---
**Author:** ![logger](https://avatars.discourse-cdn.com/v4/letter/l/34f0e0/32.png) [@logger](https://discuss.elastic.co/u/logger)\ **Post date:** [December 1, 2023, 7:38pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/7 "2023-12-01T19:38:26Z")
Awesome, I test it tomorrow and get back to you. Thanks for your advices. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 29, 2023, 7:39pm UTC](https://discuss.elastic.co/t/elastic-agent-needs-elasticseach-ca-from-elastic-cloud/348273/8 "2023-12-29T19:39:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.