# Fleet-Server Certificate issue

**URL:** <https://discuss.elastic.co/t/fleet-server-certificate-issue/328635>\
**Category:** Kibana\
**Tags:** elastic-stack-security, fleet\
**Created:** [March 27, 2023, 3:22pm UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635 "2023-03-27T15:22:23Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [March 27, 2023, 3:22pm UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/1 "2023-03-27T15:22:23Z")

</div>

Hi Community,

```auto
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: certs/elk.key
xpack.security.http.ssl.certificate: certs/elk.cer
xpack.security.http.ssl.certificate_authorities: certs/rootCA.cer

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.client_authentication: required
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

```

rootCA.cer certificate i created using openssl for testing purpose.

1. Generate certificates for fleet-server  
bin/elasticsearch-certutil cert --name fleet-server --ca-cert rootCA.crt --ca-key rootCA.key --ip 139.59.2.1 --pem
2. Run elastic-agent command to install fleet  
./elastic-agent install --url=[https://139.59.2.1:8220](https://139.59.2.1:8220)   
--fleet-server-es=[https://139.59.2.1:9200](https://139.59.2.1:9200)   
--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2Nzk5MzAyNTI0NTA6Y25wbVk1TnVUc3FGTE5GNUhGYjFSZw   
--fleet-server-policy=fleet-server-policy   
--certificate-authorities=/usr/share/elasticsearch/rootCA.crt   
--fleet-server-es-ca= /usr/share/elasticsearch/rootCA.crt  
--fleet-server-cert=/usr/share/elasticsearch/fleet-server/fleet-server.crt   
--fleet-server-cert-key=/usr/share/elasticsearch/fleet-server/fleet-server.key

I am getting this error

```auto
{"log.level":"info","@timestamp":"2023-03-27T20:48:28.669+0530","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":803},"message":"Fleet Server - Error - x509: cannot validate certificate for 139.59.2.1 because it doesn't contain any IP SANs","ecs.version":"1.6.0"}

```

Command for generating self signed ca

`openssl genrsa -des3 -out rootCA.key 4096 `  
`openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 1024 -out rootCA.crt`

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [March 29, 2023, 4:34am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/2 "2023-03-29T04:34:12Z")

</div>

Can anyone help me out please

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [April 2, 2023, 6:18am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/3 "2023-04-02T06:18:26Z")

</div>

Can anyone help me

---

<div class="post-metadata">

**Author:** ![Cristina\_Amico](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@Cristina\_Amico](https://discuss.elastic.co/u/Cristina_Amico)\
**Post date:** [April 3, 2023, 7:58am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/4 "2023-04-03T07:58:24Z")

</div>

Hello @Aniket_Pant,

Could you specify what version of the stack are you running?

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [April 3, 2023, 7:59am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/5 "2023-04-03T07:59:29Z")

</div>

I am using 8.2 version.

---

<div class="post-metadata">

**Author:** ![Cristina\_Amico](https://avatars.discourse-cdn.com/v4/letter/c/9fc29f/32.png) [@Cristina\_Amico](https://discuss.elastic.co/u/Cristina_Amico)\
**Post date:** [April 3, 2023, 8:11am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/6 "2023-04-03T08:11:27Z")

</div>

Did you follow the steps in [Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent Guide [8.2] | Elastic](https://www.elastic.co/guide/en/fleet/8.2/secure-connections.html)  
to generate the certs?

---

<div class="post-metadata">

**Author:** ![Aniket\_Pant](https://avatars.discourse-cdn.com/v4/letter/a/77aa72/32.png) [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Post date:** [April 3, 2023, 8:51am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/7 "2023-04-03T08:51:22Z")

</div>

Okay i will follow this steps and let you know.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 1, 2023, 8:51am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/328635/8 "2023-05-01T08:51:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.