# Elastic Stack Self-Managed Multi-Node – Fleet Server TLS

**URL:** <https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902>\
**Category:** Elastic Agent\
**Created:** [February 3, 2026, 10:51pm UTC](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902 "2026-02-03T22:51:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![4l13v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/4l13v/32/146872_2.png) [@4l13v](https://discuss.elastic.co/u/4l13v)\
**Post date:** [February 3, 2026, 10:51pm UTC](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902/1 "2026-02-03T22:51:36Z")

</div>

I am running a self-managed Elastic Stack (8.x) on a private network and trying to deploy Fleet Server with production TLS certificates. I am facing certificate trust and agent enrollment issues.

Then I saw on documentation that, “**When you run Elastic Agent with the Elastic Defend integration, the [TLS certificates](https://en.wikipedia.org/wiki/X.509)used to connect to Fleet Server and Elasticsearch need to be generated using [RSA](https://en.wikipedia.org/wiki/RSA_(cryptosystem))**.”

**Environment**

Infrastructure

- Proxmox VMs

- Ubuntu 24.04

- Private network 10.5.5.0/24

Nodes

- 10.5.5.4 – es-master-vote (Elasticsearch master)

- 10.5.5.5 – es-hot-1 (data)

- 10.5.5.6 – es-hot-2 (data)

- 10.5.5.7 – kibana-fleet (Kibana + Fleet Server)

Any guidance or best-practice examples for self-managed multi-node TLS + Fleet Server would be appreciated.

---

<div class="post-metadata">

**Author:** ![4l13v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/4l13v/32/146872_2.png) [@4l13v](https://discuss.elastic.co/u/4l13v)\
**Post date:** [April 9, 2026, 1:10pm UTC](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902/2 "2026-04-09T13:10:19Z")

</div>

fixed