# \--fleet-server-es-ca option does not work on Windows?

**URL:** <https://discuss.elastic.co/t/fleet-server-es-ca-option-does-not-work-on-windows/333120>\
**Category:** Elastic Agent\
**Tags:** fleet\
**Created:** [May 10, 2023, 7:38pm UTC](https://discuss.elastic.co/t/fleet-server-es-ca-option-does-not-work-on-windows/333120 "2023-05-10T19:38:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![learningelastic](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@learningelastic](https://discuss.elastic.co/u/learningelastic)\
**Post date:** [May 10, 2023, 7:38pm UTC](https://discuss.elastic.co/t/fleet-server-es-ca-option-does-not-work-on-windows/333120/1 "2023-05-10T19:38:16Z")

</div>

I'm having an issue with elastic agents Windows machines, but they work perfectly on Linux machines.

My fleet server keeps showing the status `Unhealthy` for elastic agents I've installed on Windows machines. This is the error message I see in `C:\Program Files\Elastic\Agent\data\elastic-agent-10dc6a\logs\elastic-agent-20230510-1.ndjson`

```auto
Failed reading CA certificate: open /etc/certs/archive/elasticsearch-self-signed/ca.crt: The system cannot find the path specified.

```

Why is my elastic agent trying to use a linux path on a windows machine?

This is the command I ran to start my elastic agent on Windows

```auto
 cd C:\elastic-agent-8.7.1-windows-x86_64\
.\elastic-agent.exe install --url=https://fleet.example.net:8220 `
  --enrollment-token=aUt5eEJvZ0JXMzRXa1FUblpRM246WEwxUVBhbGlRZzZ0ODhsWkdHelhJZw== `
  -a C:\elastic-agent-8.7.1-windows-x86_64\ca.crt `
  --fleet-server-es-ca C:\elastic-agent-8.7.1-windows-x86_64\ca.crt 

```

As you can see, I specified the `--fleet-server-es-ca`. I was hoping that `--fleet-server-es-ca` would tell elastic agent where to find the certificate authority. But it seems the elastic agent completely ignores the `--fleet-server-es-ca` flag.

The `--fleet-server-es-ca` works perfectly on Ubuntu 20.04. On ubuntu 20.04, the `--fleet-server-es-ca` will tell the elastic agent the location of the certificate authority necessary to connect with the elasticsearch instance.

What did I do wrong? How do I tell the elastic agent which certificate authority to use on Windows?

---

<div class="post-metadata">

**Author:** ![abhidwi27](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhidwi27/32/120097_2.png) [@abhidwi27](https://discuss.elastic.co/u/abhidwi27)\
**Post date:** [May 22, 2023, 4:21pm UTC](https://discuss.elastic.co/t/fleet-server-es-ca-option-does-not-work-on-windows/333120/2 "2023-05-22T16:21:36Z")

</div>

I'm glad to assist you with this issue. I encountered a similar problem before and banged my head to get around this.

To resolve the issue, please follow these steps:

1. Open the Kibana dashboard and navigate to "Fleet -\> Settings".
2. In the settings section, go to "Output" and click on "Edit Output".
3. In the advanced configuration, you need to paste the content, replacing `<ca>` with your self-signed authority.

To obtain the content for `<your ca>`, you can use the following command or open the file with any text editor:

```auto
cat ca.crt

```

Once you have obtained the content, paste it into the advanced configuration as shown below:

```auto
ssl:
  certificate_authorities:
  - |
    -----BEGIN CERTIFICATE-----
    <your ca>
    -----END CERTIFICATE-----

```

By following these steps, you should be able to resolve the issue and configure the necessary SSL settings for the output in Fleet.

---

<div class="post-metadata">

**Author:** ![learningelastic](https://avatars.discourse-cdn.com/v4/letter/l/958977/32.png) [@learningelastic](https://discuss.elastic.co/u/learningelastic)\
**Post date:** [May 30, 2023, 8:48pm UTC](https://discuss.elastic.co/t/fleet-server-es-ca-option-does-not-work-on-windows/333120/3 "2023-05-30T20:48:59Z")

</div>

> [@abhidwi27](#):
>
> ```auto
> ssl:
> certificate_authorities:
> - |
> -----BEGIN CERTIFICATE-----
> <your ca>
> -----END CERTIFICATE-----
> 
> ```

Nice that worked!

Now I undersstand. Basically the `ssl.certificate_authorities` in the `fleet > settings > advance.yaml` will override the `--fleet-server-es-ca` option!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2023, 8:49pm UTC](https://discuss.elastic.co/t/fleet-server-es-ca-option-does-not-work-on-windows/333120/4 "2023-06-27T20:49:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.