# Fleet Server Settings Elasticsearch CA Fingerprint Rejected

**URL:** <https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218>\
**Category:** Beats\
**Tags:** fleet\
**Created:** [February 15, 2022, 9:26am UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218 "2022-02-15T09:26:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddth\_2022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddth_2022/32/99836_2.png) [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\
**Post date:** [February 15, 2022, 9:26am UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218/1 "2022-02-15T09:26:49Z")

</div>

I tried entering the base64 encoded Fingerprint of the CA certificate in the Output section of Fleet settings, but I get the error below -  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9f635e91023bdfd53a558035d821f0d0e790cd63.png)

The string is most definitely base64 encoded. What can I do to get past this issue?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 15, 2022, 9:28am UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218/2 "2022-02-15T09:28:44Z")

</div>

How did you get that value ? Is it _actually_ the SHA256 fingerprint of a CA certificate ?

---

<div class="post-metadata">

**Author:** ![ddth\_2022](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ddth_2022/32/99836_2.png) [@ddth\_2022](https://discuss.elastic.co/u/ddth_2022)\
**Post date:** [February 15, 2022, 10:35am UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218/3 "2022-02-15T10:35:59Z")

</div>

I used `openssl x509 -fingerprint -sha256 -in ca.crt` to get the fingerprint and then converted it to base64 (as required in the error message)

---

<div class="post-metadata">

**Author:** ![nchaulet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nchaulet/32/77896_2.png) [@nchaulet](https://discuss.elastic.co/u/nchaulet)\
**Post date:** [February 15, 2022, 1:46pm UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218/4 "2022-02-15T13:46:10Z")

</div>

Hi @ddth_2022

Looks like we have a bug in the client validation of this form, I filled this issue on our side and this should be fixed in an upcoming version [[Fleet] Output CATrustedFingerPrint validation client side is broken · Issue #125661 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/125661)

In the mean time to unlock you, you can edit this settings via the API

```auto
curl --request PUT \
  --url https://{KIBANA_HOST}/api/fleet/outputs/fleet-default-output \
  --header 'kbn-xsrf: xxxx' \
  --data '{
	"name": "default",
	"type": "elasticsearch",
	"hosts": [
		"https://test.fr"
	],
	"is_default": true,
	"is_default_monitoring": true,
	"config_yaml": "#test",
	"ca_trusted_fingerprint": "yourfingerprint"
}'
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2022, 1:46pm UTC](https://discuss.elastic.co/t/fleet-server-settings-elasticsearch-ca-fingerprint-rejected/297218/5 "2022-03-15T13:46:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.