# Filebeat ERROR x509: certificate signed by unknown authority

**URL:** <https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 11, 2023, 12:12am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861 "2023-01-11T00:12:52Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 12:12am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/1 "2023-01-11T00:12:52Z")

</div>

Hi!  
in my filebeat.yaml I configured output.elasticsearch: section like this

```auto
tyoutput.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["10.142.77.174:9200"]

  # Protocol - either `http` (default) or `https`.
  protocol: "https" # changed by me

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "xxxxxxxxxxx"
  ssl:
    enabled: true
    ca_trusted_fingerprint: "E7B4EB1476CDBD2606E2EADE41373A0CE52305B3313EFE082CEF0676E2ADA4A7"

```

checked kibana.yaml - the same fingerprinf

checked in elasticsearch/certs with openssl x509 -fingerprint -sha256 -noout -in ./http\_ca.crt | awk --field-separator="=" '{print $2}' | sed 's/://g' - got the fingerprint in filebeat.yaml

according for initial/quick filebeat configuration page it should be enough  
The same configuration works on my VMware

But When I come to my real servers environment I got

```auto
filebeat test output
elasticsearch: https://10.142.77.174:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: 10.142.77.174
    dial up... OK
  TLS...
    security: server's certificate chain verification is enabled
    handshake... ERROR x509: certificate signed by unknown authority

```

What else should I check?

Thank you

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 12:27am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/2 "2023-01-11T00:27:09Z")

</div>

What Version?  
Show us your Kibana.yml?  
Perhaps / Most likely a subject name mismatch the cert does not include `10.142.77.174` as a subject name alternative.

try this from the new filebeat server with the `CA` from the elasticsearch server.

`curl -v -u elastic --cacert ./certs/http_ca.crt https://10.142.77.174:9200`

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 12:33am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/3 "2023-01-11T00:33:45Z")

</div>

kibana.yaml

```auto
# =================== System: Kibana Server ===================
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "0.0.0.0"

# Enables you to specify a path to mount Kibana at if you are running behind a proxy.
# Use the `server.rewriteBasePath` setting to tell Kibana if it should remove the basePath
# from requests it receives, and to prevent a deprecation warning at startup.
# This setting cannot end in a slash.
#server.basePath: ""

# Specifies whether Kibana should rewrite requests that are prefixed with
# `server.basePath` or require that they are rewritten by your reverse proxy.
# Defaults to `false`.
#server.rewriteBasePath: false

# Specifies the public URL at which Kibana is available for end users. If
# `server.basePath` is configured this URL should end with the same basePath.
#server.publicBaseUrl: ""

# The maximum payload size in bytes for incoming server requests.
#server.maxPayload: 1048576

# The Kibana server's name. This is used for display purposes.
#server.name: "your-hostname"

# =================== System: Kibana Server (Optional) ===================
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
# These settings enable SSL for outgoing requests from the Kibana server to the browser.
#server.ssl.enabled: false
#server.ssl.certificate: /path/to/your/server.crt
#server.ssl.key: /path/to/your/server.key

# =================== System: Elasticsearch ===================
# The URLs of the Elasticsearch instances to use for all your queries.
#elasticsearch.hosts: ["http://localhost:9200"]

# If your Elasticsearch is protected with basic authentication, these settings provide
# the username and password that the Kibana server uses to perform maintenance on the Kibana
# index at startup. Your Kibana users still need to authenticate with Elasticsearch, which
# is proxied through the Kibana server.
#elasticsearch.username: "kibana_system"
#elasticsearch.password: "pass"

# Kibana can also authenticate to Elasticsearch via "service account tokens".
# Service account tokens are Bearer style tokens that replace the traditional username/password based configuration.
# Use this token instead of a username/password.
# elasticsearch.serviceAccountToken: "my_token"

# Time in milliseconds to wait for Elasticsearch to respond to pings. Defaults to the value of
# the elasticsearch.requestTimeout setting.
#elasticsearch.pingTimeout: 1500

# Time in milliseconds to wait for responses from the back end or Elasticsearch. This value
# must be a positive integer.
#elasticsearch.requestTimeout: 30000

# The maximum number of sockets that can be used for communications with elasticsearch.
# Defaults to `Infinity`.
#elasticsearch.maxSockets: 1024

# Specifies whether Kibana should use compression for communications with elasticsearch
# Defaults to `false`.
#elasticsearch.compression: false

# List of Kibana client-side headers to send to Elasticsearch. To send *no* client-side
# headers, set this value to [] (an empty list).
#elasticsearch.requestHeadersWhitelist: [authorization]

# Header names and values that are sent to Elasticsearch. Any custom headers cannot be overwritten
# by client-side headers, regardless of the elasticsearch.requestHeadersWhitelist configuration.
#elasticsearch.customHeaders: {}

# Time in milliseconds for Elasticsearch to wait for responses from shards. Set to 0 to disable.
#elasticsearch.shardTimeout: 30000

# =================== System: Elasticsearch (Optional) ===================
# These files are used to verify the identity of Kibana to Elasticsearch and are required when
# xpack.security.http.ssl.client_authentication in Elasticsearch is set to required.
#elasticsearch.ssl.certificate: /path/to/your/client.crt
#elasticsearch.ssl.key: /path/to/your/client.key

# Enables you to specify a path to the PEM file for the certificate
# authority for your Elasticsearch instance.
#elasticsearch.ssl.certificateAuthorities: ["/path/to/your/CA.pem"]

# To disregard the validity of SSL certificates, change this setting's value to 'none'.
#elasticsearch.ssl.verificationMode: full

# =================== System: Logging ===================
# Set the value of this setting to off to suppress all logging output, or to debug to log everything. Defaults to 'info'
#logging.root.level: debug

# Enables you to specify a file where Kibana stores log output.
logging:
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders:
      - default
      - file
# layout:
# type: json

# Logs queries sent to Elasticsearch.
#logging.loggers:
# - name: elasticsearch.query
# level: debug

# Logs http responses.
#logging.loggers:
# - name: http.server.response
# level: debug

# Logs system usage information.
#logging.loggers:
# - name: metrics.ops
# level: debug

# =================== System: Other ===================
# The path where Kibana stores persistent data not saved in Elasticsearch. Defaults to data
#path.data: data

# Specifies the path where Kibana creates the process ID file.
pid.file: /run/kibana/kibana.pid

# Set the interval in milliseconds to sample system and process performance
# metrics. Minimum is 100ms. Defaults to 5000ms.
#ops.interval: 5000

# Specifies locale to be used for all localizable strings, dates and number formats.
# Supported languages are the following: English (default) "en", Chinese "zh-CN", Japanese "ja-JP", French "fr-FR".
#i18n.locale: "en"

# =================== Frequently used (Optional)===================

# =================== Saved Objects: Migrations ===================
# Saved object migrations run at startup. If you run into migration-related issues, you might need to adjust these settings.

# The number of documents migrated at a time.
# If Kibana can't start up or upgrade due to an Elasticsearch `circuit_breaking_exception`,
# use a smaller batchSize value to reduce the memory pressure. Defaults to 1000 objects per batch.
#migrations.batchSize: 1000

# The maximum payload size for indexing batches of upgraded saved objects.
# To avoid migrations failing due to a 413 Request Entity Too Large response from Elasticsearch.
# This value should be lower than or equal to your Elasticsearch cluster’s `http.max_content_length`
# configuration option. Default: 100mb
#migrations.maxBatchSizeBytes: 100mb

# The number of times to retry temporary migration failures. Increase the setting
# if migrations fail frequently with a message such as `Unable to complete the [...] step after
# 15 attempts, terminating`. Defaults to 15
#migrations.retryAttempts: 15

# =================== Search Autocomplete ===================
# Time in milliseconds to wait for autocomplete suggestions from Elasticsearch.
# This value must be a whole number greater than zero. Defaults to 1000ms
#unifiedSearch.autocomplete.valueSuggestions.timeout: 1000

# Maximum number of documents loaded by each shard to generate autocomplete suggestions.
# This value must be a whole number greater than zero. Defaults to 100_000
#unifiedSearch.autocomplete.valueSuggestions.terminateAfter: 100000

# This section was automatically generated during setup.
elasticsearch.hosts: ['https://10.142.77.174:9200']
elasticsearch.serviceAccountToken: AAEAAWVsYXN0aWMva2liYW5hL2Vucm9sbC1wcm9jZXNzLXRva2VuLTE2NjgwMzIzMzExMDU6ZVhiMVFPRFBUOUtBSGhtZkNhbjgyZw
elasticsearch.ssl.certificateAuthorities: [/var/lib/kibana/ca_1668032331523.crt]
xpack.fleet.outputs: [{id: fleet-default-output, name: default, is_default: true, is_default_monitoring: true, type: elasticsearch, hosts: ['https://10.142.77.174:9200'], ca_trusted_fingerprint: e7b4eb1476cdbd2606e2eade41373a0ce52305b3313efe082cef0676e2ada4a7}]

```

sorry I didnt get the last suggestion  
I have 3 files in /etc/elasticsearch/certs / http\_ca.crt http.p12 transport.p12

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 12:40am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/4 "2023-01-11T00:40:20Z")

</div>

Try

`curl -v -u elastic --cacert ./certs/http_ca.crt https://10.142.77.174:9200`

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 12:58am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/5 "2023-01-11T00:58:43Z")

</div>

I did run curl -v -u elastic --cacert ./http\_ca.crt [https://10.142.77.174:9200](https://10.142.77.174:9200)

our environment does not allow to copy files between servers or download them on home pc.. so I created http\_ca.crt on filebeat, assigned 660 rights and run from local dir

output:

```auto
curl -v -u elastic --cacert ./http_ca.crt https://10.142.77.174:9200
Enter host password for user 'elastic':
* About to connect() to 10.142.77.174 port 9200 (#0)
* Trying 10.142.77.174...
* Connected to 10.142.77.174 (10.142.77.174) port 9200 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
* Closing connection 0
curl: (77) Problem with the SSL CA cert (path? access rights?)

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 1:01am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/6 "2023-01-11T01:01:21Z")

</div>

You might need to use a full path.. and make sure it is readable by the user running curl... (linux 🙂 ) or WAIT is this on Windows?

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:02am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/7 "2023-01-11T01:02:03Z")

</div>

no Linux

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 1:03am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/8 "2023-01-11T01:03:12Z")

</div>

full path make sure it can be accessed / read

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:03am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/9 "2023-01-11T01:03:45Z")

</div>

[root@dlx-stg-dal-app-11-p ~]# curl -v -u elastic --cacert /root/http\_ca.crt [https://10.142.77.174:9200](https://10.142.77.174:9200)  
Enter host password for user 'elastic':

- About to connect() to 10.142.77.174 port 9200 (#0)
- Trying 10.142.77.174...
- Connected to 10.142.77.174 (10.142.77.174) port 9200 (#0)
- Initializing NSS with certpath: sql:/etc/pki/nssdb
- Closing connection 0  
curl: (77) Problem with the SSL CA cert (path? access rights?)

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:04am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/10 "2023-01-11T01:04:00Z")

</div>

I'm running from root

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 1:04am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/11 "2023-01-11T01:04:26Z")

</div>

> [@vassiliy.vins](#):
>
> Closing connection 0  
> curl: (77) Problem with the SSL CA cert (path? access rights?)

I mean the error is saying the same thing...

I just ran this command on my Ubuntu 20 it ran fine.

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:05am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/12 "2023-01-11T01:05:11Z")

</div>

yeap.. and perfectly works on my VMware

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 1:06am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/13 "2023-01-11T01:06:08Z")

</div>

> [@vassiliy.vins](#):
>
> yeap.. and perfectly works on my VMware

What does that mean... what works perfectly?

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:07am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/14 "2023-01-11T01:07:08Z")

</div>

the same configuration, made with the same steps - works on my VMware.. different certificates of course

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:07am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/15 "2023-01-11T01:07:52Z")

</div>

can we avoid ssl check? I've seen some configuration somewhere

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 1:09am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/16 "2023-01-11T01:09:16Z")

</div>

`ssl.verification_mode: "none"`

> **[Configure SSL | Filebeat Reference \[8.6\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html)**

There is a simple mistake somewhere... sometimes those are the hardest to find 😉

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:09am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/17 "2023-01-11T01:09:32Z")

</div>

in filebeat configuration?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [January 11, 2023, 1:10am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/18 "2023-01-11T01:10:52Z")

</div>

instead of this... I linked the docs 🙂 Above

> [@vassiliy.vins](#):
>
> `ca_trusted_fingerprint`

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:12am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/19 "2023-01-11T01:12:43Z")

</div>

```auto
There is a simple mistake somewhere... sometimes those are the hardest to find :wink:

```

that's very true

---

<div class="post-metadata">

**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\
**Post date:** [January 11, 2023, 1:13am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/20 "2023-01-11T01:13:43Z")

</div>

OK, let's stop for today.. I will come tomorrow.. may be reinstall ELK from scratch

[Next page](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861.md?page=2)