# SSL Certificate issues **URL:** \ **Category:** Elasticsearch\ **Created:** [November 17, 2023, 8:27am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390 "2023-11-17T08:27:45Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 17, 2023, 8:27am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/1 "2023-11-17T08:27:45Z")
I am trying to set up a server to evaluate and determine if/how we can use this solution. Unfortunately I am going mad trying to set it up. I have been trying, searching, reading and trying again for over a week now and I keep hitting the same error. I have seen plenty of others running into the same or similar problems, but there is either no solution given or I don't understand it. I hope someone here can point me in the right direction. I'm using a VM running Server 2022 Std for OS - Elasticsearch is up and running - Kibana is up and running, properly enrolled - Fleet server is up and running, status healthy So far so good. However, if I try (optional) step 3 in the Elasticsearch Installation guide, checking the Elasticsearch cluster with an authenticated cURL call, that fails with this error: _curl: (60) schannel: CertGetCertificateChain trust error CERT\_TRUST\_REVOCATION\_STATUS\_UNKNOWN_ But the rest of the setup steps are all fine right up to the point where I want to connect addional agents. Agent setup fails with tthe following error: _Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority_ I have checked, converted and imported the certificates I found in %ES\_HOME%\config\certs but that does not help. I did notice that the fingerprint I was given during initial setup corresponds to the fingerprint that is shown in the Fleet server config, but that the http\_ca.crt and http.p12 certificates have a different fingerprint. What am I missing and where can I find the certificate with the fingerprint that is showing in my Fleet server? ---
**Author:** ![VijayIQA](https://avatars.discourse-cdn.com/v4/letter/v/e19b73/32.png) [@VijayIQA](https://discuss.elastic.co/u/VijayIQA)\ **Post date:** [November 17, 2023, 10:45am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/2 "2023-11-17T10:45:50Z")
can you provide your configuration which was in elasticsearh.yml file. Note: Hide the sensitive information. ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 17, 2023, 10:53am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/3 "2023-11-17T10:53:41Z")
Sure. I have not made any changes (yet). Removing a lot of commented lines, this is what remains: \*\*\* elasticsearch.yml \*\*\* xpack.security.enabled: true xpack.security.enrollment.enabled: true xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12 xpack.security.transport.ssl: enabled: true verification\_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 cluster.initial\_master\_nodes: ["HOSTNAME"] http.host: 0.0.0.0 \*\*\* end of file \*\*\* ---
**Author:** ![VijayIQA](https://avatars.discourse-cdn.com/v4/letter/v/e19b73/32.png) [@VijayIQA](https://discuss.elastic.co/u/VijayIQA)\ **Post date:** [November 17, 2023, 11:47am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/4 "2023-11-17T11:47:21Z")
how you are calling API can you past here. ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 17, 2023, 12:23pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/5 "2023-11-17T12:23:08Z")
Sorry, not sure what you mean here. This is de cURL commend that fails immediately after starting up Elasticsearch: _curl --cacert %ES\_HOME%\config\certs\http\_ca.crt -u elastic:$ELASTIC\_PASSWORD [https://xxx.xxx.xxx.xxx:9200](https://xxx.xxx.xxx.xxx:9200)_ That produces this error: _curl: (60) schannel: CertGetCertificateChain trust error CERT\_TRUST\_REVOCATION\_STATUS\_UNKNOWN_ And this is the install command I used to try to install an additional agent: _.\elastic-agent.exe install --url=[https://xxx.xxx.xxx.xxx:8220](https://xxx.xxx.xxx.xxx:8220) --enrollment-token=xxxxxxxxxxxxxxxxxxxxx_ And that produces this error: _Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority_ ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 19, 2023, 7:33pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/6 "2023-11-19T19:33:08Z")
Anyone else that can help? I just don't understand why I run into a certificate error right after initial setup of Elasticsearch, before I even edit a thing. Would I have more success if I move to Ubuntu for OS ? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 20, 2023, 1:39am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/7 "2023-11-20T01:39:54Z")
Run the curl with the `-v` switch you will get more details. Also assuming you read this carefully? > **[Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent...](https://www.elastic.co/guide/en/fleet/current/secure-connections.html)** ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 20, 2023, 11:38am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/8 "2023-11-20T11:38:44Z")
Thanks for your reply Stephen. The -v switch was is good tip, although it only provided more questions. This line in the output stands out: _schannel: using IP address, SNI is not supported by OS._ SNI is support by Windows Server since long. I'll go over the manual page you refer to again (but yes, I have done so a couple of times already). Will report back with the results later. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 20, 2023, 2:59pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/9 "2023-11-20T14:59:18Z")
Yes sorry I'm not the best with windows SSL. It seems sometimes there are some special requirements there. If you share the output, perhaps I can help. Often what we see is people putting IPs in the certs and then using domain name or vice versa or putting the IPs and the DNS fields of the certs So there's mismatches all those have to be aligned properly. ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 22, 2023, 3:34pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/11 "2023-11-22T15:34:54Z")
I started over again. Fresh VM and install. But again I am hitting the same problems. Reading the article you linked to again and again, it gets more unclear for me every time I read it. I've got a few questions: - Installing the Fleet Server agent works just fine using the fingerprint from the http\_ca.p12 certificate. The other agents I want to enroll into the Fleet require a different certificate? - I create a new ca.crt and key file. Do these file replace the http\_ca.p12 file that was created during setup? - Where do the fleet-server.crt and key file go that were created? ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 22, 2023, 4:08pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/12 "2023-11-22T16:08:11Z")
I ran into an option I had not seen before. This provided me with a solution (at least for this setup) I have added --insecure to the installation string for my Agents. Agents are installing and connecting just fine now. I know it's not a solution, but it's a workaround I can live with right now. Thanks for trying to help. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 22, 2023, 6:48pm UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/13 "2023-11-22T18:48:42Z")
Hi @nvanalphen Self Managed Fleet with Self Signed Certs is Tricky, we do our best on the documentation but I think understanding the flow is important to.. Agents talk to BOTH Fleet and Elasticsearch and the certs need to be correct for both... per the images on [This](https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html) pages (probably without the load balancer) In short you need to get fleet setup correctly with the Correct Certs between Fleet and Elasticsearch Then You need to Install Agents / Fleet Correct you will noticed in the Examples [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html#_examples_13) if you look closely some of the cert setting related to Elasticsearch and Some the Fleet Server you have to get that all right... If you GET the Fleet server all correct (which is an Agent that has a Fleet Server In It) them it will go mostly smooth after that. Yes I have got this all working without the `--insecure` I did it on linux and it took me a try or two. ---
**Author:** ![nvanalphen](https://avatars.discourse-cdn.com/v4/letter/n/53a042/32.png) [@nvanalphen](https://discuss.elastic.co/u/nvanalphen)\ **Post date:** [November 23, 2023, 8:14am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/14 "2023-11-23T08:14:56Z")
Thanks Stephen! These pages do improve my understanding. I will definitely be going over them extensively later again. For now my initial setup is running and starting to produce some nice graphics and insights. I look forward to diving into that some more too ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 21, 2023, 8:15am UTC](https://discuss.elastic.co/t/ssl-certificate-issues/347390/15 "2023-12-21T08:15:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.