# Fleet Elasticsearch CA trusted fingerprint

**URL:** <https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200>\
**Category:** Kibana\
**Created:** [February 14, 2022, 10:53pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200 "2022-02-14T22:53:55Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![EliWallic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eliwallic/32/66544_2.png) [@EliWallic](https://discuss.elastic.co/u/EliWallic)\
**Post date:** [February 14, 2022, 10:53pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/1 "2022-02-14T22:53:55Z")

</div>

Hello community,

i am trying to setup my first fleet server and figured out that i can set the ca fingerprint as default.  
So I tried under fFleet \> Settings \> Output to set as wanted but i am getting the error:  
CA trusted fingerprint should be a base64 CA sha256 fingerprint

Docs: [Install Elasticsearch with RPM | Elasticsearch Guide [8.0] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/rpm.html#_use_the_ca_fingerprint_4)

Does anyone know which format is required?

Best Regards

---

<div class="post-metadata">

**Author:** ![nchaulet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nchaulet/32/77896_2.png) [@nchaulet](https://discuss.elastic.co/u/nchaulet)\
**Post date:** [February 15, 2022, 1:46pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/2 "2022-02-15T13:46:32Z")

</div>

Hi @EliWallic

Looks like we have a bug in the client validation of this form, I filled this issue on our side and this should be fixed in an upcoming version [[Fleet] Output CATrustedFingerPrint validation client side is broken · Issue #125661 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/125661)

In the mean time to unlock you, you can edit this settings via the API

```auto
curl --request PUT \
  --url https://{KIBANA_HOST}/api/fleet/outputs/fleet-default-output \
  --header 'kbn-xsrf: xxxx' \
  --data '{
	"name": "default",
	"type": "elasticsearch",
	"hosts": [
		"https://test.fr"
	],
	"is_default": true,
	"is_default_monitoring": true,
	"config_yaml": "#test",
	"ca_trusted_fingerprint": "yourfingerprint"
}'
```

---

<div class="post-metadata">

**Author:** ![EliWallic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eliwallic/32/66544_2.png) [@EliWallic](https://discuss.elastic.co/u/EliWallic)\
**Post date:** [February 15, 2022, 8:16pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/3 "2022-02-15T20:16:26Z")

</div>

Hi @nchaulet

thanks for that. I tried to use your code but got some errors. In my case i had to add --insecure and -u elastic:password  
After that I still get an error:

```auto
curl -u elastic:password \
  --insecure \
  --request POST \
  --url https://127.0.0.1:5601/api/fleet/outputs/fleet-default-output \
  --header 'kbn-xsrf: true' \
  --data '{
	"name": "default",
	"type": "elasticsearch",
	"hosts": [
		"https://localhost:9200"
	],
	"is_default": true,
	"is_default_monitoring": true,
	"config_yaml": "#test",
	"ca_trusted_fingerprint": "87:29:43:88:E1.....B5:70:E1:55:91:63"
}'

```

```auto
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

```

Also if I use the webserver instead of the kibana service itself with --url [https://localhost/api/fleet/outputs/fleet-default-output](https://localhost/api/fleet/outputs/fleet-default-output) \ I am getting the following:

```auto
{"statusCode":404,"error":"Not Found","message":"Not Found"}

```

Not sure whats wrong in any case.

Best Regards

---

<div class="post-metadata">

**Author:** ![nchaulet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nchaulet/32/77896_2.png) [@nchaulet](https://discuss.elastic.co/u/nchaulet)\
**Post date:** [February 15, 2022, 8:32pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/4 "2022-02-15T20:32:37Z")

</div>

> [@EliWallic](#):
>
> ```auto
> curl -u elastic:password \
> --insecure \
> --request POST \
> --url https://127.0.0.1:5601/api/fleet/outputs/fleet-default-output \
> --header 'kbn-xsrf: true' \
> --data '{
> "name": "default",
> "type": "elasticsearch",
> "hosts": [
> "https://localhost:9200"
> ],
> "is_default": true,
> "is_default_monitoring": true,
> "config_yaml": "#test",
> "ca_trusted_fingerprint": "87:29:43:88:E1.....B5:70:E1:55:91:63"
> }'
> 
> ```

Hi @EliWallic  
Are you using TLS on your Kibana instance? if not you should probably replace the `https` by `http` for the `ca_trusted_fingerprint` format you should the use sha256 fingerprint and not the formated version something like `87294388e1...b570e15591631`

---

<div class="post-metadata">

**Author:** ![EliWallic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eliwallic/32/66544_2.png) [@EliWallic](https://discuss.elastic.co/u/EliWallic)\
**Post date:** [February 15, 2022, 8:40pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/5 "2022-02-15T20:40:38Z")

</div>

Hi @nchaulet  
Kibana itselt is not configured with TLS only via nginx.  
I tried it with:

```auto
--url http://localhost:5601/api/fleet/outputs/fleet-default-output

```

but its still the same error

Best Regards

---

<div class="post-metadata">

**Author:** ![Balu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balu/32/37569_2.png) [@Balu](https://discuss.elastic.co/u/Balu)\
**Post date:** [February 22, 2022, 12:09pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/6 "2022-02-22T12:09:17Z")

</div>

Did you get this working in the meantime?

I am getting `{"statusCode":400,"error":"Bad Request","message":"[......]: definition for this key is missing"}` as a reply.

---

<div class="post-metadata">

**Author:** ![Balu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balu/32/37569_2.png) [@Balu](https://discuss.elastic.co/u/Balu)\
**Post date:** [February 22, 2022, 12:40pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/7 "2022-02-22T12:40:45Z")

</div>

Ok, I might have figured this out - as usual just after I have asked the question ;)...

First I had to get the configured outputs:

```auto
curl -u {user}:{pass} --request GET \
  --url https://{kibana-host}/api/fleet/outputs

```

This returned an {ID} I could use instead of `fleet-default-output`. I also needed an additional `Content-Type` header:

```auto
curl -u {user}:{pass} --request PUT \
  --url https://{kibana-host}/api/fleet/outputs/{ID} \
  --header 'Content-Type: application/json' \
  --header 'kbn-xsrf: xxxx' \
  --data '{
	"name": "default",
	"type": "elasticsearch",
	"hosts": [
            "https://{elasticsearch-host}:9200"
	],
	"is_default": true,
	"is_default_monitoring": true,
	"config_yaml": "",
	"ca_trusted_fingerprint": "{fingerprint}"
}'

```

For the fingerprint I used the one without ":", even though both versions seemed to work.

---

<div class="post-metadata">

**Author:** ![EliWallic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eliwallic/32/66544_2.png) [@EliWallic](https://discuss.elastic.co/u/EliWallic)\
**Post date:** [February 22, 2022, 10:05pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/8 "2022-02-22T22:05:59Z")

</div>

Yes i used the certificate itself in the YAML Advanced configuration:

```auto
			ssl:
			  certificate_authorities:
			  - |
			    -----BEGIN CERTIFICATE-----

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 22, 2022, 10:06pm UTC](https://discuss.elastic.co/t/fleet-elasticsearch-ca-trusted-fingerprint/297200/9 "2022-03-22T22:06:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.