# Fleet Server - Certificate Challenges!
**URL:** https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896
**Category:** Elasticsearch
**Tags:** fleet
**Created:** [February 22, 2022, 12:56pm UTC](https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896 "2022-02-22T12:56:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)
#### Post date: [February 22, 2022, 12:56pm UTC](https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896/1 "2022-02-22T12:56:25Z")
Hello
When i try to register Fleet Server using a certificate, it is getting successfully registered. But the problem is, it is throwing "Generating self-signed certificate for Fleet Server" after executing the command as shown below. This might be the reason when i try to register an VM to this Fleet Server using the certificate i' am getting an exception "x509 certificate signed by unknown authority".
So trying to see if the root cause of the issue is "my fleet server" is not configured properly using CA certificate. Please help.
```auto
sudo ./elastic-agent install -f --url=https://XX1prdelkfleet01:8220 \
> --fleet-server-es=https://mo1prdelkmstr01:9200 \
> --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NDU0MzU3NTMwMjY6RmduZUU1RGNTeHlEb2lKVHdEVjRRZw \
> --fleet-server-policy=9de5f020-8e76-11ec-9794-bf083a8b07e7 \
> --certificate-authorities= /etc/ssl/certs/elkprd.crt \
> --fleet-server-es-ca= /tmp/elkprd.crt \
> --fleet-server-cert= /tmp/elkprd.crt \
> --fleet-server-cert-key= /tmp/elkprd.key
2022-02-21T06:34:43.470-0500 INFO cmd/enroll_cmd.go:354 Generating self-signed certificate for Fleet Server
2022-02-21T06:34:45.887-0500 INFO cmd/enroll_cmd.go:701 Fleet Server - Starting
2022-02-21T06:34:46.888-0500 INFO cmd/enroll_cmd.go:682 Fleet Server - Running on policy with Fleet Server integration: 9de5f020-8e76-11ec-9794-bf083a8b07e7; missing config fleet.agent.id (expected during bootstrap process)
2022-02-21T06:34:47.692-0500 INFO cmd/enroll_cmd.go:414 Starting enrollment to URL: https://mo1prdelkfleet01:8220/
2022-02-21T06:34:48.482-0500 INFO cmd/enroll_cmd.go:252 Successfully triggered restart on running Elastic Agent.
```
---
### Author:  [@mwoods269](https://discuss.elastic.co/u/mwoods269)
#### Post date: [March 2, 2022, 12:33am UTC](https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896/2 "2022-03-02T00:33:01Z")
It appears by your config that you are not providing the correct CA cert at line
`--fleet-server-es-ca= /tmp/elkprd.crt \`
Sample config from one of my environments where our first elasticnode also acts as our CA
```auto
--certificate-authorities=/etc/elasticsearch/certificates/elastic-stack-ca.crt \
--fleet-server-es-ca=/etc/elasticsearch/certificates/elastic-stack-ca.crt \
--fleet-server-cert=/etc/elasticsearch/certificates/fleet-server.crt \
--fleet-server-cert-key=/etc/elasticsearch/certificates/fleet-server.key
```
Also note placing the cert here where required will allow that instance to trust it
/etc/ssl/certs# cp /tmp/elastic-stack-ca.crt ./
Don't forget to run the update command: **update-ca-certificates**
> **[update-ca-certificates: update /etc/ssl/certs and ca-certificates.crt - Linux...](https://www.systutorials.com/docs/linux/man/8-update-ca-certificates/)**
>
> This manual page documents briefly the update-ca-certificates command. update-ca-certificates is a program that updates the directory /etc/ssl/certs to hold SSL
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 30, 2022, 12:33am UTC](https://discuss.elastic.co/t/fleet-server-certificate-challenges/297896/3 "2022-03-30T00:33:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.