# Fleet enroll with --ca-sha256 **URL:** \ **Category:** Elastic Agent\ **Created:** [November 27, 2022, 8:43pm UTC](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891 "2022-11-27T20:43:37Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![adrien\_moreau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrien_moreau/32/101590_2.png) [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Post date:** [November 27, 2022, 8:43pm UTC](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891/1 "2022-11-27T20:43:37Z")
Hello, I am trying to enroll an elastic-agent to a self managed fleet server using the `--ca-sha256` parameter. I have setup the fleet server security following this guide: > **[Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent...](https://www.elastic.co/guide/en/fleet/current/secure-connections.html)** If I try to enroll the agent using the following command: `./elastic-agent install --url= --enrollment-token= --certificate-authorities=/path/to/ca.crt` Where ca.crt is the same as in the linked article, that is to say "The CA certificate to use to connect to Fleet Server. This is the CA used to generate a certificate and key for Fleet Server" Then my elastic agent gets correctly enrolled. However if I try to enroll using the ca fingerprint: `./elastic-agent install --url= --enrollment-token= --ca-256=` then I get an error message: `Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority` Why is there any difference between the 2 options? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 25, 2022, 8:44pm UTC](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891/2 "2022-12-25T20:44:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.