# Fleet agent - x509: certificate signed by unknown authority

**URL:** https://discuss.elastic.co/t/fleet-agent-x509-certificate-signed-by-unknown-authority/298157
**Category:** Beats
**Tags:** fleet
**Created:** [February 24, 2022, 12:01pm UTC](https://discuss.elastic.co/t/fleet-agent-x509-certificate-signed-by-unknown-authority/298157 "2022-02-24T12:01:37Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![gabrielfsousa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabrielfsousa/32/116946_2.png) [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)
#### Post date: [February 24, 2022, 12:01pm UTC](https://discuss.elastic.co/t/fleet-agent-x509-certificate-signed-by-unknown-authority/298157/1 "2022-02-24T12:01:37Z")

</div>

I have one fleet server, and 3 elastic agents in a K8S cluster.  
server:

```auto
--env FLEET_ENROLL=1\
--env FLEET_SERVER_ENABLE=1\
--env FLEET_SERVER_ELASTICSEARCH_HOST=$(ELASTICSEARCHHOST)\
--env FLEET_SERVER_SERVICE_TOKEN=$(SERVICETOKEN)\
--env FLEET_SERVER_POLICY_ID=$(POLICYID)\
--env FLEET_SERVER_INSECURE_HTTP=true\
--env FLEET_INSECURE=true\
--env ELASTICSEARCH_USERNAME=user\
--env ELASTICSEARCH_PASSWORD=pass\
--env ELASTICSEARCH_CA=/usr/share/elastic-agent/2.crt\
--env FLEET_SERVER_ELASTICSEARCH_CA=/usr/share/elastic-agent/2.crt\
--volume /opt/elasticsearch/certs/ca.crt:/usr/share/elastic-agent/ca.crt:ro\
--volume /home/user/fleet/1.crt:/usr/share/elastic-agent/1.crt:ro\
--volume /home/user/fleet/2.crt:/usr/share/elastic-agent/2.crt:ro\

```

agent:

```auto

           env:
 16 - name: FLEET_ENROLL
 15 value: "1"
 14 # Set to true in case of insecure or unverified HTTP
 13 - name: FLEET_INSECURE
 12 value: "true"
 11 # The ip:port pair of fleet server
 10 - name: FLEET_URL
  9 value: "http://10.252.28.70:8220"
  8 # If left empty KIBANA_HOST, KIBANA_FLEET_USERNAME, KIBANA_FLEET_PASSWORD are needed
  7 - name: FLEET_ENROLLMENT_TOKEN
  6 value: "NWhCQm8zMEJMeGhVbEM1cDlnMUY6bFg0dTE3NElRMGEyQmVhRFllUm1xUQ=="
  5 - name: KIBANA_HOST
  4 value: ""
  3 - name: KIBANA_FLEET_USERNAME
  2 value: ""
  1 - name: KIBANA_FLEET_PASSWORD
43 value: ""
  1 - name: ELASTICSEARCH_CA
  2 value: "/tmp/2.crt"
  3 - name: FLEET_SERVER_ELASTICSEARCH_CA
  4 value: "/tmp/2.crt"

```

error:

```auto
{"log.level":"error","@timestamp":"2022-02-24T11:51:42.959Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/output.go","file.line":154},"message":"Failed to connect to backoff(elasticsearch(https://xlog:9200)): Get \"https://xlog:9200\": x509: certificate signed by unknown authority","service.name":"metricbeat","ecs.version":"1.6.0"}

```

what im missing ?  
from the fleet server i dont have any error related with certs.

---

<div class="post-metadata">

### Author: ![gabrielfsousa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gabrielfsousa/32/116946_2.png) [@gabrielfsousa](https://discuss.elastic.co/u/gabrielfsousa)
#### Post date: [February 25, 2022, 12:35pm UTC](https://discuss.elastic.co/t/fleet-agent-x509-certificate-signed-by-unknown-authority/298157/2 "2022-02-25T12:35:39Z")

</div>

found how to fix it.

in Kibana UI in "Fleet settings"  
added in "Elasticsearch output configuration (YAML)"

```auto
ssl.certificate_authorities: ["/tmp/2.crt"]

```

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca8fafa955e4ac71446309da882ed1d0b7645a48.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 25, 2022, 2:36pm UTC](https://discuss.elastic.co/t/fleet-agent-x509-certificate-signed-by-unknown-authority/298157/3 "2022-03-25T14:36:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.