# Fleet Server won't start - certificate error **URL:** \ **Category:** Elastic Security\ **Tags:** fleet\ **Created:** [June 1, 2021, 10:48am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617 "2021-06-01T10:48:23Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![finbarr996](https://avatars.discourse-cdn.com/v4/letter/f/db5fbb/32.png) [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Post date:** [June 1, 2021, 10:48am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617/1 "2021-06-01T10:48:23Z")
I've been running 7.12 with 10 test endpoints all operating in Fleet without any problem. After upgrading to 7.13, I'm trying to re-deploy to the test endpoints (after manually removing the previous agent on each endpoint) however, the Fleet server won't start and produces the following output: > sudo ./elastic-agent install -f --fleet-server-es=[https://elastic.test.local:9200](https://elastic.test.local:9200) --fleet-server-service-token=AAE-deleted-QQ > The Elastic Agent is currently in BETA and should not be used in production > 2021-06-01T10:18:01.989Z INFO cmd/enroll\_cmd.go:300 Generating self-signed certificate for Fleet Server > 2021-06-01T10:18:03.527Z INFO cmd/enroll\_cmd.go:610 Waiting for Elastic Agent to start Fleet Server > 2021-06-01T10:18:07.535Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Starting > 2021-06-01T10:18:08.536Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > 2021-06-01T10:18:14.547Z INFO cmd/enroll\_cmd.go:648 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > ... > ... > 2021-06-01T10:19:13.654Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Restarting > 2021-06-01T10:19:14.656Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > 2021-06-01T10:19:20.665Z INFO cmd/enroll\_cmd.go:648 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > 2021-06-01T10:19:24.674Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Restarting > 2021-06-01T10:19:25.675Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > 2021-06-01T10:19:31.684Z INFO cmd/enroll\_cmd.go:648 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > ... > ... > 2021-06-01T10:19:57.722Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Restarting > 2021-06-01T10:19:58.723Z INFO cmd/enroll\_cmd.go:643 Fleet Server - Error - x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "Elastic Certificate Tool Autogenerated CA") > Error: fleet-server never started by elastic-agent daemon: context canceled > Error: enroll command failed with exit code: 1 I have an locally autogenerated ca.crt, which is registered in the local certifcate store - all other TLS/xpack certificate security aspects of this host work fine. I get these errors when trying to use the local Elasticsearch host as the Fleet server (my preferred option, as it's always up) and the same error on a Windows host - which also has the root ca certificate in the trusted root store, and can access Kibana without generating errors. I'm not sure where to go next - certificates all worked perfectly fine until the upgrade. Cheers, John. ---
**Author:** ![Koji\_Kawamura](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/koji_kawamura/32/93938_2.png) [@Koji\_Kawamura](https://discuss.elastic.co/u/Koji_Kawamura)\ **Post date:** [June 3, 2021, 2:12am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617/2 "2021-06-03T02:12:31Z")
Hi John, I encountered the same error and just found another discussion here. > [@Cannot Install Fleet Server](https://discuss.elastic.co/t/cannot-install-fleet-server/274764): > > Hello there, Server info: 1 - I´m running ubuntu server 18.04 2 - Elk stack running on 7.13 version I´m trying to add a fleet server on a self managed host but no luck. Following the kibana instructions this is what I´m getting so far: 1 - From kibana screen, I´m trying to add the fleet server 2 - Downloaded the elastic agent to the same elk server (DEB x64 version) 3 - Generated the token 4 - Followed the instructions for the commands to be used Then, I receive a lot of X509 errors. So… As written in the discussion, adding `--fleet-server-es-ca` addressed the error in my case, too: ```auto sudo ./elastic-agent install -f --fleet-server-es=https://localhost:9200 --fleet-server-es-ca=/usr/local/etc/elastic/elasticsearch-ca.pem --fleet-server-service-token=AAEAA...Mdw ``` I hope this helps! ---
**Author:** ![finbarr996](https://avatars.discourse-cdn.com/v4/letter/f/db5fbb/32.png) [@finbarr996](https://discuss.elastic.co/u/finbarr996)\ **Post date:** [June 3, 2021, 9:06am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617/3 "2021-06-03T09:06:51Z")
> [@Koji\_Kawamura](#): > > `--fleet-server-es-ca=` Kawamura-san, Arigatou! That worked perfectly - thank you very much for your help. Yororshiku! John. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 1, 2021, 9:07am UTC](https://discuss.elastic.co/t/fleet-server-wont-start-certificate-error/274617/4 "2021-07-01T09:07:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.