# Elastic Agent show \`Error dialing x509: certificate signed by unknown authority\` but it is healthy in fleet

**URL:** <https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514>\
**Category:** Elastic Agent\
**Created:** [April 6, 2023, 12:56pm UTC](https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514 "2023-04-06T12:56:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kelvin\_Chan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kelvin_chan/32/119470_2.png) [@Kelvin\_Chan](https://discuss.elastic.co/u/Kelvin_Chan)\
**Post date:** [April 6, 2023, 12:56pm UTC](https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514/1 "2023-04-06T12:56:46Z")

</div>

I am building elastic stack for testing, which uses self-signed certificate. And i use docker compose to deploy them.

Here is part of compose

```yml
  efleet:
    image: docker.elastic.co/beats/elastic-agent:${STACK_VERSION}
    volumes:
      - certs:/usr/share/elastic-agent/certs
    environment:
      - FLEET_ENROLLMENT_TOKEN=<TOEKN>
      - FLEET_ENROLL=1
      - FLEET_URL=https://efleet:8220
      - FLEET_SERVER_ENABLE=1
      - FLEET_SERVER_HOST=0.0.0.0
      - FLEET_SERVER_ELASTICSEARCH_HOST=https://es01:9200
      - FLEET_SERVER_SERVICE_TOKEN=<TOEKN>
      - FLEET_SERVER_POLICY_ID=fleet-server-policy
      - FLEET_CA=/usr/share/elastic-agent/certs/ca/ca.crt
      - FLEET_SERVER_ELASTICSEARCH_CA=/usr/share/elastic-agent/certs/ca/ca.crt
      - FLEET_SERVER_CERT=/usr/share/elastic-agent/certs/efleet/efleet.crt
      - FLEET_SERVER_CERT_KEY=/usr/share/elastic-agent/certs/efleet/efleet.key
    deploy:
      resources:
        limits:
          memory: ${MEM_LIMIT}
    networks:
      - fleet

  agent01:
    image: docker.elastic.co/beats/elastic-agent:${STACK_VERSION}
    volumes:
      - certs:/usr/share/elastic-agent/certs
    environment:
      - FLEET_ENROLLMENT_TOKEN=<TOKEN>
      - FLEET_ENROLL=1
      - FLEET_URL=https://efleet:8220
      - FLEET_SERVER_HOST=0.0.0.0
      - FLEET_CA=/usr/share/elastic-agent/certs/ca/ca.crt
      - FLEET_INSECURE=true
    deploy:
      resources:
        limits:
          memory: ${MEM_LIMIT}
    networks:
      - fleet

```

I built up fleet and agent server, and kibana fleet shows them are healthy, but no data coming from agent. Then i watch docker log

```json
{
    "log.level": "error",
    "@timestamp": "2023-04-06T12:36:39.768Z",
    "message": "Error dialing x509: certificate signed by unknown authority",
    "component": {
        "binary": "metricbeat",
        "dataset": "elastic_agent.metricbeat",
        "id": "http/metrics-monitoring",
        "type": "http/metrics"
    },
    "log": {
        "source": "http/metrics-monitoring"
    },
    "log.origin": {
        "file.line": 38,
        "file.name": "transport/logging.go"
    },
    "address": "es04:9200",
    "ecs.version": "1.6.0",
    "log.logger": "esclientleg",
    "service.name": "metricbeat",
    "network": "tcp",
    "ecs.version": "1.6.0"
}

```

Note: i can successfully access es01-es04

---

<div class="post-metadata">

**Author:** ![Kelvin\_Chan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kelvin_chan/32/119470_2.png) [@Kelvin\_Chan](https://discuss.elastic.co/u/Kelvin_Chan)\
**Post date:** [April 6, 2023, 2:22pm UTC](https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514/2 "2023-04-06T14:22:33Z")

</div>

Update: My fleet got certificate error, which is same as agent. I forget to check fleet log while im writing question

I use this script to create certificates

```yaml
  setup:
    image: docker.elastic.co/elasticsearch/elasticsearch:${STACK_VERSION}
    volumes:
      - certs:/usr/share/elasticsearch/config/certs
    user: "0"
    command: >
      bash -c '
        if [x${ELASTIC_PASSWORD} == x]; then
          echo "Set the ELASTIC_PASSWORD environment variable in the .env file";
          exit 1;
        elif [x${KIBANA_PASSWORD} == x]; then
          echo "Set the KIBANA_PASSWORD environment variable in the .env file";
          exit 1;
        fi;
        if [! -f config/certs/ca.zip]; then
          echo "Creating CA";
          bin/elasticsearch-certutil ca --silent --pem -out config/certs/ca.zip;
          unzip config/certs/ca.zip -d config/certs;
        fi;
        if [! -f config/certs/certs.zip]; then
          echo "Creating certs";
          echo -ne \
          "instances:\n"\
          " - name: es01\n"\
          " dns:\n"\
          " - es01\n"\
          " - localhost\n"\
          " ip:\n"\
          " - 127.0.0.1\n"\
          " - name: es02\n"\
          " dns:\n"\
          " - es02\n"\
          " - localhost\n"\
          " ip:\n"\
          " - 127.0.0.1\n"\
          " - name: es03\n"\
          " dns:\n"\
          " - es03\n"\
          " - localhost\n"\
          " ip:\n"\
          " - 127.0.0.1\n"\
          " - name: es04\n"\
          " dns:\n"\
          " - es04\n"\
          " - localhost\n"\
          " ip:\n"\
          " - 127.0.0.1\n"\
          " - name: efleet\n"\
          " dns:\n"\
          " - efleet\n"\
          " - localhost\n"\
          " ip:\n"\
          " - 127.0.0.1\n"\
          > config/certs/instances.yml;
          bin/elasticsearch-certutil cert --silent --pem -out config/certs/certs.zip --in config/certs/instances.yml --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key;
          unzip config/certs/certs.zip -d config/certs;
        fi;
        echo "Setting file permissions"
        chown -R root:root config/certs;
        find . -type d -exec chmod 750 \{\} \;;
        find . -type f -exec chmod 640 \{\} \;;
        echo "Waiting for Elasticsearch availability";
        until curl -s --cacert config/certs/ca/ca.crt https://es01:9200 | grep -q "missing authentication credentials"; do sleep 30; done;
        echo "Setting kibana_system password";
        until curl -s -X POST --cacert config/certs/ca/ca.crt -u "elastic:${ELASTIC_PASSWORD}" -H "Content-Type: application/json" https://es01:9200/_security/user/kibana_system/_password -d "{\"password\":\"${KIBANA_PASSWORD}\"}" | grep -q "^{}"; do sleep 10; done;
        echo "All done!";
      '
    healthcheck:
      test: ["CMD-SHELL", "[ -f config/certs/es01/es01.crt]" ]
      interval: 1s
      timeout: 5s
      retries: 120
    networks:
      - fleet

```

Fleet error

```json
{
    "log.level": "error",
    "@timestamp": "2023-04-06T12:59:44.123Z",
    "message": "Failed to connect to backoff(elasticsearch(https://es01:9200)): Get \"https://es01:9200\": x509: certificate signed by unknown authority",
    "component": {
        "binary": "metricbeat",
        "dataset": "elastic_agent.metricbeat",
        "id": "beat/metrics-monitoring",
        "type": "beat/metrics"
    },
    "log": {
        "source": "beat/metrics-monitoring"
    },
    "log.logger": "publisher_pipeline_output",
    "log.origin": {
        "file.line": 150,
        "file.name": "pipeline/client_worker.go"
    },
    "service.name": "metricbeat",
    "ecs.version": "1.6.0",
    "ecs.version": "1.6.0"
}

```

---

<div class="post-metadata">

**Author:** ![Kelvin\_Chan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kelvin_chan/32/119470_2.png) [@Kelvin\_Chan](https://discuss.elastic.co/u/Kelvin_Chan)\
**Post date:** [April 6, 2023, 3:45pm UTC](https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514/3 "2023-04-06T15:45:20Z")

</div>

After i read [relative answer](https://discuss.elastic.co/t/elastic-agent-error-dialing-x509-certificate-signed-by-unknown-authority/315675/5) then add fingerprint to _Elasticsearch CA trusted fingerprint (optional)_ and `ssl.certificate_authorities: ["/usr/share/elastic-agent/certs/ca/ca.crt"] ` to _Advanced YAML configuration_. Agent and Fleet run successfully, but i still want to ask if i can set those arguments before docker compose build up?

---

<div class="post-metadata">

**Author:** ![Kelvin\_Chan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kelvin_chan/32/119470_2.png) [@Kelvin\_Chan](https://discuss.elastic.co/u/Kelvin_Chan)\
**Post date:** [April 7, 2023, 5:09am UTC](https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514/4 "2023-04-07T05:09:06Z")

</div>

There are two way to specify CA path

The first one is to follow this instruction: [Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent Guide [8.7] | Elastic](https://www.elastic.co/guide/en/fleet/current/secure-connections.html), and add `ssl.certificate_authorities: ["/usr/share/elastic-agent/certs/ca/ca.crt"]` to **Advanced YAML configuration**

The second one is to configure _elastic-agent.yml_ directly, you can find `ssl.certificate_authorities`  
in this \* [SSL/TLS](https://www.elastic.co/guide/en/fleet/current/elastic-agent-ssl-configuration.html).

Note: this settings seems to be `dynamic`, [Configuring Elasticsearch | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/settings.html#dynamic-cluster-setting)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 5, 2023, 5:09am UTC](https://discuss.elastic.co/t/elastic-agent-show-error-dialing-x509-certificate-signed-by-unknown-authority-but-it-is-healthy-in-fleet/329514/5 "2023-05-05T05:09:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.