# Fleet Server - Error - x509: certificate signed by unknown authority

**URL:** <https://discuss.elastic.co/t/fleet-server-error-x509-certificate-signed-by-unknown-authority/283168>\
**Category:** Beats\
**Tags:** docker, fleet\
**Created:** [September 2, 2021, 1:03pm UTC](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-signed-by-unknown-authority/283168 "2021-09-02T13:03:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JimG](https://avatars.discourse-cdn.com/v4/letter/j/f1d935/32.png) [@JimG](https://discuss.elastic.co/u/JimG)\
**Post date:** [September 2, 2021, 1:03pm UTC](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-signed-by-unknown-authority/283168/1 "2021-09-02T13:03:39Z")

</div>

Hi everyone 🙂

Im trying to make a test setup with a Ubuntu 20.04 , running with docker.

I use docker-compose to make elastic agent/fleet server, but i cant make it work with a self signed certificate for fleet, elasticsearch and kibana and by adding the insecure to my docker-compose file.

I use this guide for setting up Elasticsearch & kibana, and confirmed that it did work.

[Running the Elastic Stack on Docker | Getting Started [7.14] | Elastic](https://www.elastic.co/guide/en/elastic-stack-get-started/current/get-started-docker.html)

For Fleet / Elastic agent i have used following for inspiration:

[Fleet Server installation options - Elastic Stack / Kibana - Discuss the Elastic Stack](https://discuss.elastic.co/t/fleet-server-installation-options/274261/4)

[Quick start: Get logs, metrics, and uptime data into the Elastic Stack | Fleet User Guide [7.14] | Elastic](https://www.elastic.co/guide/en/fleet/current/fleet-quick-start.html)

[Run Elastic Agent in a container | Fleet User Guide [7.14] | Elastic](https://www.elastic.co/guide/en/fleet/current/elastic-agent-container.html)

My docker-compose looks like this:

```auto
version: "3.7"
services:
  elastic-agent:
    image: docker.elastic.co/beats/elastic-agent:7.14.0
    container_name: fleet01
    restart: always
    user: root
    environment:
      - FLEET_ENROLL=1
      - FLEET_URL="https://ip:port"
      - FLEET_SERVER_ENABLE=true
      - ELASTICSEARCH_HOST=https://ip:port
      - FLEET_SERVER_SERVICE_TOKEN=SECRET
      - FLEET_CA=$CERTS_DIR/ca/ca.crt
      - CERTIFICATE_AUTHORITIES=$CERTS_DIR/ca/ca.crt
      - FLEET_SERVER_ES_CA=$CERTS_DIR/ca/ca.crt
      - FLEET_SERVER_CERT=$CERTS_DIR/fleet01/fleet01.crt
      - FLEET_SERVER_CERT_KEY=$CERTS_DIR/fleet01/fleet01.key
      - FLEET_SERVER_POLICY=72495520-03e7-11ec-8ffc-b16ddd514078
      - FLEET_INSECURE=1
      - FLEET_SERVER_INSECURE_HTTP=0
    volumes:
      - certs:$CERTS_DIR
    networks:
      - es_elastic
volumes:
  certs:
    external: true
    name: es_certs

networks:
  es_elastic:
    external: true
    name: es_elastic

```

Logs i get with command docker logs fleet01

```auto

2021-09-02T12:22:24.713Z INFO cmd/enroll_cmd.go:526 Spawning Elastic Agent daemon as a subprocess to complete bootstrap process.
2021-09-02T12:22:24.879Z INFO application/application.go:66 Detecting execution mode
2021-09-02T12:22:24.881Z INFO application/application.go:87 Agent is in Fleet Server bootstrap mode
2021-09-02T12:22:25.000Z INFO [api] api/server.go:62 Starting stats endpoint
2021-09-02T12:22:25.000Z INFO application/fleet_server_bootstrap.go:124 Agent is starting
2021-09-02T12:22:25.000Z INFO [api] api/server.go:64 Metrics endpoint listening on: /usr/share/elastic-agent/state/data/tmp/elastic-agent.sock (configured: unix:///usr/share/elastic-agent/state/data/tmp/elastic-agent.sock)
2021-09-02T12:22:25.001Z INFO application/fleet_server_bootstrap.go:134 Agent is stopped
2021-09-02T12:22:25.002Z INFO stateresolver/stateresolver.go:48 New State ID is btYyflaV
2021-09-02T12:22:25.002Z INFO stateresolver/stateresolver.go:49 Converging state requires execution of 1 step(s)
2021-09-02T12:22:25.513Z INFO log/reporter.go:40 2021-09-02T12:22:25Z - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-09-02T12:22:25.514Z INFO stateresolver/stateresolver.go:66 Updating internal state
2021-09-02T12:22:25.717Z INFO cmd/enroll_cmd.go:701 Fleet Server - Starting
2021-09-02T12:22:26.534Z ERROR status/reporter.go:236 Elastic Agent status changed to: 'error'
***2021-09-02T12:22:26.535Z ERROR log/reporter.go:36 2021-09-02T12:22:26Z - message: Application: fleet-server--7.14.0[]: State changed to FAILED: Error - x509: certificate signed by unknown authority - type: 'ERROR' - sub_type: 'FAILED'***
2021-09-02T12:22:26.719Z INFO cmd/enroll_cmd.go:701 Fleet Server - Error - x509: certificate signed by unknown authority
2021-09-02T12:22:32.729Z INFO cmd/enroll_cmd.go:706 Fleet Server - Error - x509: certificate signed by unknown authority
2021-09-02T12:22:36.536Z INFO status/reporter.go:236 Elastic Agent status changed to: 'online'
2021-09-02T12:22:36.536Z INFO log/reporter.go:40 2021-09-02T12:22:36Z - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: - type: 'STATE' - sub_type: 'STARTING'
2021-09-02T12:22:36.536Z INFO log/reporter.go:40 2021-09-02T12:22:36Z - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-09-02T12:22:36.536Z INFO log/reporter.go:40 2021-09-02T12:22:36Z - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: Restarting - type: 'STATE' - sub_type: 'STARTING'

```

---

<div class="post-metadata">

**Author:** ![JimG](https://avatars.discourse-cdn.com/v4/letter/j/f1d935/32.png) [@JimG](https://discuss.elastic.co/u/JimG)\
**Post date:** [September 6, 2021, 1:52pm UTC](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-signed-by-unknown-authority/283168/2 "2021-09-06T13:52:13Z")

</div>

Solved.. but ran into another problem.

I was missing FLEET\_SERVER\_ELASTICSEARCH=$CERTS\_DIR/ca/ca.crt

The error i got is below, seems like there is a problem with a config file which is missing. i'll look into this, if anyone got the same problem or have a solution please write a comment. 🙂

note on error. I did change with ip address from the original log generated with docker logs

```auto
2021-09-06T13:15:25.445Z INFO cmd/enroll_cmd.go:508 Spawning Elastic Agent daemon as a subprocess to complete bootstrap process.
2021-09-06T13:15:25.610Z INFO application/application.go:66 Detecting execution mode
2021-09-06T13:15:25.612Z INFO application/application.go:87 Agent is in Fleet Server bootstrap mode
2021-09-06T13:15:26.029Z INFO [api] api/server.go:62 Starting stats endpoint
2021-09-06T13:15:26.029Z INFO application/fleet_server_bootstrap.go:124 Agent is starting
2021-09-06T13:15:26.029Z INFO [api] api/server.go:64 Metrics endpoint listening on: /usr/share/elastic-agent/state/data/tmp/elastic-agent.sock (configured: unix:///usr/share/elastic-agent/state/data/tmp/elastic-agent.s ock)
2021-09-06T13:15:26.030Z INFO application/fleet_server_bootstrap.go:134 Agent is stopped
2021-09-06T13:15:26.031Z INFO stateresolver/stateresolver.go:48 New State ID is yut-NVDG
2021-09-06T13:15:26.031Z INFO stateresolver/stateresolver.go:49 Converging state requires execution of 1 step(s)
2021-09-06T13:15:26.525Z INFO log/reporter.go:40 2021-09-06T13:15:26Z - message: Application: fleet-server--7.14.1[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-09-06T13:15:26.526Z INFO stateresolver/stateresolver.go:66 Updating internal state
2021-09-06T13:15:27.450Z INFO cmd/enroll_cmd.go:683 Fleet Server - Starting
2021-09-06T13:15:28.048Z WARN status/reporter.go:236 Elastic Agent status changed to: 'degraded'
2021-09-06T13:15:28.048Z INFO log/reporter.go:40 2021-09-06T13:15:28Z - message: Application: fleet-server--7.14.1[]: State changed to DEGRADED: Running on policy with Fleet Server integration: 64c04440-0f13-11ec-9032-e581 7e7d572b; missing config fleet.agent.id (expected during bootstrap process) - type: 'STATE' - sub_type: 'RUNNING'
2021-09-06T13:15:28.453Z INFO cmd/enroll_cmd.go:664 Fleet Server - Running on policy with Fleet Server integration: 64c04440-0f13-11ec-9032-e5817e7d572b; **missing config fleet.agent.id** (expected during bootstrap process)
2021-09-06T13:15:28.454Z WARN [tls] tlscommon/tls_config.go:98 SSL/TLS verifications disabled.
2021-09-06T13:15:29.376Z INFO cmd/enroll_cmd.go:396 Starting enrollment to URL: ip:8220
2021-09-06T13:15:29.480Z WARN [tls] tlscommon/tls_config.go:98 SSL/TLS verifications disabled.
2021-09-06T13:15:29.481Z WARN cmd/enroll_cmd.go:407 Remote server is not ready to accept connections, will retry in a moment.
2021-09-06T13:16:29.482Z INFO cmd/enroll_cmd.go:414 Retrying enrollment to URL: my ip:8220
2021-09-06T13:16:29.584Z WARN cmd/enroll_cmd.go:407 Remote server is not ready to accept connections, will retry in a moment.

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2021, 1:52pm UTC](https://discuss.elastic.co/t/fleet-server-error-x509-certificate-signed-by-unknown-authority/283168/3 "2021-10-04T13:52:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.