# Error dialing x509: certificate signed by unknown authority Kubernetes integration
**URL:** https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859
**Category:** Elasticsearch
**Created:** [November 20, 2024, 9:26pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859 "2024-11-20T21:26:35Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@clockard](https://discuss.elastic.co/u/clockard)
#### Post date: [November 20, 2024, 9:26pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/1 "2024-11-20T21:26:35Z")
I know there is allot on info about this, but I'm not grokking what needs to be done.
The agents for the integration with kubernetes deploys in the kube-system namespace. i am using the quickstart fyi. What do i need to do to get the cert that was generated in the eck name space to the agents in kube-system?
```auto
Error dialing x509: certificate signed by unknown authority
```
this is the cert i want yes?
```auto
elasticsearch-es-http-ca-internal
```
---
### Author:  [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)
#### Post date: [November 21, 2024, 3:47pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/2 "2024-11-21T15:47:23Z")
I think you need to take a look on configuration files of elasticsearch you will find the certificate on the directory and the name on elasticsearch.yml file
- did u use self-signed certificate or public ?
if it self signe just make the authority certificate of elasticsearch certificate trusted in the server
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 21, 2024, 6:55pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/3 "2024-11-21T18:55:03Z")
It may depend on where that error was logged and whether that error occurs during fleet enrollment or while interacting with Elasticsearch
If it's for the output to Elasticsearch the CA can be specified here
If the issue is fleet enrollment you can either set FLEET\_INSECURE to true or you can mount the ca certificate into the container and set FLEET\_CA to grab the self signed CA
---
### Author:  [@clockard](https://discuss.elastic.co/u/clockard)
#### Post date: [November 21, 2024, 9:41pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/4 "2024-11-21T21:41:49Z")
I Didn't create any certificates it's all just done via the operator right?
This is ECK FYI
---
### Author:  [@clockard](https://discuss.elastic.co/u/clockard)
#### Post date: [November 21, 2024, 9:54pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/5 "2024-11-21T21:54:52Z")
Thank you again for your help, Fleet is good! It's just all the metrics reporting to elastic.
```auto
{"log.level":"error","@timestamp":"2024-11-21T21:45:37.018Z","message":"Error dialing x509: certificate signed by unknown authority","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"kubernetes/metrics-default","type":"kubernetes/metrics"},"log":{"source":"kubernetes/metrics-default"},"log.origin":{"file.line":39,"file.name":"transport/logging.go","function":"github.com/elastic/elastic-agent-libs/transport/httpcommon.(*HTTPTransportSettings).RoundTripper.LoggingDialer.func2"},"service.name":"metricbeat","network":"tcp","address":"elasticsearch-es-http.eck.svc:9200","ecs.version":"1.6.0","log.logger":"esclientleg","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-11-21T21:45:37.018Z","message":"Ping request failed with: Get \"https://elasticsearch-es-http.eck.svc:9200\": x509: certificate signed by unknown authority","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"kubernetes/metrics-default","type":"kubernetes/metrics"},"log":{"source":"kubernetes/metrics-default"},"log.logger":"esclientleg","log.origin":{"file.line":306,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-11-21T21:45:40.567Z","message":"Failed to connect to backoff(elasticsearch(https://elasticsearch-es-http.eck.svc:9200)): Get \"https://elasticsearch-es-http.eck.svc:9200\": x509: certificate signed by unknown authority","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"service.name":"metricbeat","ecs.version":"1.6.0","log.logger":"publisher_pipeline_output","log.origin":{"file.line":148,"file.name":"pipeline/client_worker.go","function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-11-21T21:45:40.567Z","message":"Attempting to reconnect to backoff(elasticsearch(https://elasticsearch-es-http.eck.svc:9200)) with 1190 reconnect attempt(s)","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"log.origin":{"file.line":139,"file.name":"pipeline/client_worker.go","function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run"},"service.name":"metricbeat","ecs.version":"1.6.0","log.logger":"publisher_pipeline_output","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-11-21T21:45:40.567Z","message":"ES Ping(url=https://elasticsearch-es-http.eck.svc:9200)","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"service.name":"metricbeat","ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":302,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping"},"ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-11-21T21:45:40.577Z","message":"Error dialing x509: certificate signed by unknown authority","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"address":"elasticsearch-es-http.eck.svc:9200","service.name":"metricbeat","network":"tcp","ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":39,"file.name":"transport/logging.go","function":"github.com/elastic/elastic-agent-libs/transport/httpcommon.(*HTTPTransportSettings).RoundTripper.LoggingDialer.func2"},"ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2024-11-21T21:45:40.577Z","message":"Ping request failed with: Get \"https://elasticsearch-es-http.eck.svc:9200\": x509: certificate signed by unknown authority","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":306,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping"},"service.name":"metricbeat","ecs.version":"1.6.0"}
```
I am also seeing a ca certificate in the pod/container itself. I actually deleted it out of the container deleted the deployment and reapplied thinking it might have had an old certificate or something but I don't know where that certificate is coming from/
```auto
ls -l /etc/ssl/certs/
-rw-r--r-- 1 root root 219342 Oct 10 10:11 ca-certificates.crt
```
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 21, 2024, 10:10pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/6 "2024-11-21T22:10:41Z")
Yes, you can read more here:
> **[TLS certificates | Elastic Cloud on Kubernetes \[master\] | Elastic](https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-tls-certificates.html)**
By default, it creates a self-signed CA and issues certificates to each component.
That screenshot is just showing that you've currently got the default fleet policy configured in your ECK CRD manifest. You shared the CRD in your other post:
```auto
---
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
name: kibana
namespace: eck
spec:
version: 8.15.3
count: 1
elasticsearchRef:
name: elasticsearch
http:
service:
spec:
type: LoadBalancer
config:
xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.eck.svc:9200"]
xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.eck.svc:8220"]
xpack.fleet.packages:
- name: system
version: latest
- name: elastic_agent
version: latest
- name: fleet_server
version: latest
xpack.fleet.agentPolicies:
- name: Fleet Server on ECK policy
id: eck-fleet-server
namespace: eck
monitoring_enabled:
- logs
- metrics
unenroll_timeout: 900
package_policies:
- name: fleet_server-1
id: fleet_server-1
package:
name: fleet_server
- name: Elastic Agent on ECK policy
id: eck-agent
namespace: eck
monitoring_enabled:
- logs
- metrics
unenroll_timeout: 900
package_policies:
- name: system-1
id: system-1
package:
name: system
```
You could remove the config and manage it via the GUI or you could add `xpack.fleet.agents.elasticsearch.ca_sha256` to the CRD and populate it with the base64-encoded string of the SHA-256 fingerprint of the CA Cert which in ECK is called something ending with `-es-http-ca-internal`
---
### Author:  [@clockard](https://discuss.elastic.co/u/clockard)
#### Post date: [November 22, 2024, 12:02am UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/7 "2024-11-22T00:02:45Z")
Like this?
```auto
---
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
name: kibana
namespace: eck
spec:
version: 8.15.3
count: 1
elasticsearchRef:
name: elasticsearch
http:
service:
spec:
type: LoadBalancer
config:
xpack.fleet.agents.elasticsearch.ca_sha256: ["NjdiMTg1NDA0YTMwZThmNWFlYzkxMDAyYjIwNzVkYTk0N2RjOWU2Mg=="]
xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.eck.svc:9200"]
xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.eck.svc:8220"]
xpack.fleet.packages:
```
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 22, 2024, 2:00am UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/8 "2024-11-22T02:00:58Z")
Yeah, that's what I would expect assuming that's the base64 encoded version of the sha256 of the ca cert
After setting that you should see it appear in the fleet output settings as well
---
### Author:  [@clockard](https://discuss.elastic.co/u/clockard)
#### Post date: [November 25, 2024, 5:29am UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/9 "2024-11-25T05:29:44Z")
I've tried every combination of every certificate certificate fingerprint and base encoded a 64 and I cannot get it to work.
This is the steps that I've taken.
i get the cert from kubernets secret
```auto
kubectl get secrets -n eck elasticsearch-es-http-ca-internal -o json | jq -r '.data."tls.crt"' | base64 -d > ecki.crt
-----BEGIN CERTIFICATE-----
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
etc...
-----END CERTIFICATE-----
```
Then i get the Finger print
```auto
openssl x509 -in ecki.crt -noout -fingerprint -sha256
SHA256 Fingerprint=47:C5:BF:5E:4F:4D:AE:DB:B6:D3:6A:DE:7E:92:1B:6E:66:08:10:1B:83:25:81:EE:80:DE:5F:0D:A7:1F:AE:31
```
then i remove the ":"
```auto
47C5BF5E4F4DAEDBB6D36ADE7E921B6E6608101B832581EE80DE5F0DA71FAE31
```
then I base64 encode it
```auto
R8W/Xk9Nrtu202refpIbbmYIEBuDJYHugN5fDacfrjE=
```
I put it in my yaml like so
```auto
---
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
name: kibana
namespace: eck
spec:
version: 8.15.3
count: 1
elasticsearchRef:
name: elasticsearch
http:
service:
spec:
type: LoadBalancer
config:
xpack.fleet.agents.elasticsearch.ca_sha256: "R8W/Xk9Nrtu202refpIbbmYIEBuDJYHugN5fDacfrjE="
xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.eck.svc:9200"]
xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.eck.svc:8220"]
xpack.fleet.packages:
```
nothing shows up in fleet out setting
I am working off this Definition
```auto
xpack.fleet.agents.elasticsearch.ca_sha256
Hash pin used for certificate verification. The pin is a base64-encoded string of the SHA-256 fingerprint.
```
I've tried using the non hash fingerprint i've tried using the entire certificate I don't know if this is an order of operations issue because I can't get that fingerprint till the all-in-one is deployed does need something extra to grab that config like a restart or something?
To sum up my question how do i get the agents in the kube-system To talk to elasticsearch with the default created secrets done by the operator? I just wanted to be clear.
Thank you for everyone's time for reading this I appreciate it again I'm just trying to learn and understand i've been reading documentation I've been going to Github looking for any open issues and reading through manifest there I'm really trying. Obviously I'm not understanding something .
---
### Author:  [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 25, 2024, 3:42pm UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/10 "2024-11-25T15:42:10Z")
Could you try the workaround provided here [Certificate ca\_sha256 ignored in Fleet initialisation config file · Issue #139411 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/139411)
Where you define a `xpack.fleet.outputs:` with `ca_trusted_fingerprint` defined?
---
### Author:  [@clockard](https://discuss.elastic.co/u/clockard)
#### Post date: [November 26, 2024, 5:01am UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/11 "2024-11-26T05:01:58Z")
Thank you so much your post what I did just so if anyone finds this in the future it'll make more sense than it did to me.
```auto
---
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
name: kibana
namespace: eck
spec:
version: 8.15.3
count: 1
elasticsearchRef:
name: elasticsearch
config:
# xpack.fleet.agents.elasticsearch.ca_sha256: "R8W/Xk9Nrtu202refpIbbmYIEBuDJYHugN5fDacfrjE="
# xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.eck.svc:9200"]
xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.eck.svc:8220"]
xpack.fleet.outputs:
- id: fleet-default-output
name: Default
type: elasticsearch
hosts: ["https://elasticsearch-es-http.eck.svc:9200"]
# openssl x509 -fingerprint -sha256 -noout -in tls/kibana/elasticsearch-ca.pem (colons removed)
ca_trusted_fingerprint: 47C5BF5E4F4DAEDBB6D36ADE7E921B6E6608101B832581EE80DE5F0DA71FAE31
is_default: true
is_default_monitoring: true
etc....
```
---
### Author:  [@orion-ua](https://discuss.elastic.co/u/orion-ua)
#### Post date: [January 29, 2026, 1:49am UTC](https://discuss.elastic.co/t/error-dialing-x509-certificate-signed-by-unknown-authority-kubernetes-integration/370859/12 "2026-01-29T01:49:56Z")
If you want to use ECK-managed certificates without specifying `xpack.fleet.outputs` in the Kibana config, run the Fleet Server agent and the Elastic Agent as root:
```auto
eck-fleet-server:
enabled: true
fullnameOverride: fleet-server
version: 9.2.4
kibanaRef:
name: kibana
elasticsearchRefs:
- name: elasticsearch
statefulSet:
replicas: 1
podTemplate:
metadata:
labels:
app.kubernetes.io/name: fleet-server-agent
spec:
serviceAccountName: fleet-server
automountServiceAccountToken: true
securityContext: # <------- Run agent as root to use
runAsUser: 0 # <------- ECK-manager certificates
policyID: eck-fleet-server
```
I faced this issue because I was using the ECK chart examples for Fleet Server, which do not include parameters for running as the root user:
- [eck-fleet-server chart example](https://github.com/elastic/cloud-on-k8s/blob/a886ddaacca19c9d03c54b1609262081274b620c/deploy/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml)
- [eck-stack chart example with fleet-server](https://github.com/elastic/cloud-on-k8s/blob/a886ddaacca19c9d03c54b1609262081274b620c/deploy/eck-stack/examples/agent/fleet-agents.yaml#L105-L122)
This information is not quite obvious in the documentation:
> [Fleet-managed Elastic Agent - Running as a non-root user](https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/configuration-fleet#k8s-elastic-agent-running-as-a-non-root-user)
> In addition to these decisions, if you are running Elastic Agent in Fleet mode as a non-root user, you must configure `ssl.certificate_authorities` in each `xpack.fleet.outputs` to trust the CA of the Elasticsearch Cluster.
Which means that if you run the agent as the root user, the certificates will be configured automatically.