# ElasticSearch self-signed Certificate error

**URL:** <https://discuss.elastic.co/t/elasticsearch-self-signed-certificate-error/374835>\
**Category:** Elasticsearch\
**Tags:** docker\
**Created:** [February 20, 2025, 9:18pm UTC](https://discuss.elastic.co/t/elasticsearch-self-signed-certificate-error/374835 "2025-02-20T21:18:33Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeanne1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeanne1/32/141332_2.png) [@jeanne1](https://discuss.elastic.co/u/jeanne1)\
**Post date:** [February 20, 2025, 9:18pm UTC](https://discuss.elastic.co/t/elasticsearch-self-signed-certificate-error/374835/1 "2025-02-20T21:18:33Z")

</div>

Hi,  
On my local ubuntu machine, I am running elasticsearch via docker container:

```auto
docker run --name es01 --net elastic -p 9200:9200 -it -m 1GB \
  -e "discovery.type=single-node" \
  -e "network.host=0.0.0.0" \
  docker.elastic.co/elasticsearch/elasticsearch:8.17.2

```

On the other side, I am running 3 docker containers via docker compose where they are running APIs.  
One of the container should access to elasticsearch. Everything is working well with cert\_verifs=False. However, with cert\_verifs=True and using the default `http_ca.crt`, I got an error that the certificate is not validate for es01 which makes sense as it validate only for localhost if I understand correctly. I try to create a new certificate and adding the es01 to the dns list using these commands:

`elasticsearch-certutil ca --pem --out elastic-stack-ca.zip`

```auto
elasticsearch-certutil cert --name es01 \
  --dns es01 --dns host.docker.internal \
  --ip 127.0.0.1 \
  --ca-cert path/to/ca/ca.crt \
  --ca-key path/to/ca/ca.key \
  --pem --out es01-cert.zip

```

I use ca.crt as the certificate and copy it into the docker container that run the API. I added it as well in the `ca-certificates` by adding this line in the docker file:

```auto
COPY ca.crt /usr/local/share/ca-certificates/ca.crt
RUN update-ca-certificates

```

However, I still get the famous error:  
**elastic\_transport.TlsError: TLS error caused by: SSLError([SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed: self-signed certificate in certificate chain**