# Error while enrolling: fail to execute the HTTP POST request: Post https://A.B.C:443/api/beats/agent/XXX-XXX-XXX-XXX-XXX: x509: certificate signed by unknown authority **URL:** \ **Category:** Beats\ **Tags:** fleet\ **Created:** [February 7, 2019, 4:46am UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377 "2019-02-07T04:46:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [February 7, 2019, 4:46am UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/1 "2019-02-07T04:46:03Z")
Hello World! @pierhugues am still trying to get an answer to following: > [@Central Management (Beta)](https://discuss.elastic.co/t/central-management-beta/160413/3): > > # filebeat enroll https://A.B.C:443 XYZ Error while enrolling: fail to execute the HTTP POST request: Post https://A.B.C:443/api/beats/agent/XXX-XXX-XXX-XXX-XXX: x509: certificate signed by unknown authority # I use GoDaddy's wildcard certificate. Any ideas? Is there a work around or ... Please advise. ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [February 7, 2019, 11:11am UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/2 "2019-02-07T11:11:09Z")
You may have to install the CA's intermediate certificate in addition to the server certificate on your server. When using certificates in PEM format (ASCII armoured Base64 encoded), you can append the intermediate certificate to the server certificate (`cat server.crt intermediate.crt > chain.crt`) and deploy the chained certificate instead. ---
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [February 7, 2019, 6:01pm UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/3 "2019-02-07T18:01:47Z")
following are the steps I took in order to get rid of that error: ``` cd /usr/local/share/ca-certificates/ wget https://ssl-ccp.godaddy.com/repository/gdig2.crt.pem wget https://ssl-ccp.godaddy.com/repository/sfig2.crt.pem update-ca-certificates ``` ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [February 14, 2019, 2:49pm UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/4 "2019-02-14T14:49:04Z")
Thanks for posting your solution. However, usually the better approach is what I tried (badly) to explain previously. In your environment, assuming that `gdig2.crt.pem` is the intermediate certificate used to sign your server certificate, concatenate your server certificate and the intermediate `cat server.pem gdig2.crt.pem > server_chain.pem` Then configure Elasticsearch and Kibana to use `server_chain.pem` instead of `server.pem`. On each TLS request, the chained certificate will be returned to the client, and there is no need merge these intermediate certificates into the system CA store. ---
**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\ **Post date:** [February 15, 2019, 3:36am UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/5 "2019-02-15T03:36:28Z")
- [Encrypting communications in Kibana | Kibana User Guide [6.6] | Elastic](https://www.elastic.co/guide/en/kibana/current/configuring-tls.html#configuring-tls) - [Configuring Kibana | Kibana User Guide [6.6] | Elastic](https://www.elastic.co/guide/en/kibana/current/settings.html) * * * what was missing is: `server.ssl.certificateAuthorities` > List of paths to PEM encoded certificate files that should be trusted. and there is no need to daisy chain certificates) i believe _that_ is better way to solve this issue) ---
**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\ **Post date:** [February 15, 2019, 9:36am UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/6 "2019-02-15T09:36:22Z")
Thanks again for sharing the missing piece in your solution. Yes, for non-public CAs, the `server.ssl.certificateAuthorities` setting is required, and it can also be used to make intermediate CA's available to Beats. For certificate chains that are anchored on public CAs, I still prefer chaining the certs on my servers. Whatever works! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 15, 2019, 11:36am UTC](https://discuss.elastic.co/t/error-while-enrolling-fail-to-execute-the-http-post-request-post-https-a-b-c-443-api-beats-agent-xxx-xxx-xxx-xxx-xxx-x509-certificate-signed-by-unknown-authority/167377/7 "2019-03-15T11:36:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.