# X509: certificate signed by unknown authority

**URL:** https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572
**Category:** Elastic Agent
**Created:** [March 13, 2023, 2:43pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572 "2023-03-13T14:43:19Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![AbbysS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbyss/32/118389_2.png) [@AbbysS](https://discuss.elastic.co/u/AbbysS)
#### Post date: [March 13, 2023, 2:43pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/1 "2023-03-13T14:43:19Z")

</div>

Hi everyone,

I'm new on the forum.

I'm little confuse, i try to learn many tutorials on fleet server / agent but i don't know how i can create my own certificate to deploy in production.

I try to learn the ELK tutorial but i think i make a mistake.

my error message is : x509: certificate signed by unknown authority

It appear it's not recommended to use --insecure mode in production, it's why i need your help.

Thanks a lot

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 13, 2023, 3:30pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/2 "2023-03-13T15:30:47Z")

</div>

Hi @AbbysS Welcome to the community.

Take a look [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html#elastic-agent-install-command):

You can try to use these flags when you install the fleet server to reference the CAs you created which may solve your issue.

```auto
                      [--fleet-server-es-ca <string>]
                      [--fleet-server-es-ca-trusted-fingerprint <string>] 

```

```auto
elastic-agent install --fleet-server-es <string>
                      --fleet-server-service-token <string>
                      [--ca-sha256 <string>]
                      [--certificate-authorities <string>]
                      [--delay-enroll]
                      [--fleet-server-cert <string>] 
                      [--fleet-server-cert-key <string>]
                      [--fleet-server-es-ca <string>]
                      [--fleet-server-es-ca-trusted-fingerprint <string>] 
                      [--fleet-server-host <string>]
                      [--fleet-server-insecure-http]
                      [--fleet-server-policy <string>]
                      [--fleet-server-port <uint16>]
                      [--force]
                      [--non-interactive]
                      [--help]
                      [--tag <string>]
                      [--url <string>] 
                      [--fleet-server-es-insecure]
                      [global-flags]

```

---

<div class="post-metadata">

### Author: ![AbbysS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbyss/32/118389_2.png) [@AbbysS](https://discuss.elastic.co/u/AbbysS)
#### Post date: [March 13, 2023, 3:32pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/3 "2023-03-13T15:32:43Z")

</div>

Hi @stephenb ,

The the command i use to install my fleet server :

curl -L -O [https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.6.2-linux-x86\_64.tar.gz](https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.6.2-linux-x86_64.tar.gz)  
tar xzvf elastic-agent-8.6.2-linux-x86\_64.tar.gz  
cd elastic-agent-8.6.2-linux-x86\_64  
sudo ./elastic-agent install --url=[https://myIP:8220](https://myIP:8220)   
--fleet-server-es=[https://myIP:9200](https://myIP:9200)   
--fleet-server-service-token=MYTOKEN   
--fleet-server-policy=POLICY   
--fleet-server-es-ca-trusted-fingerprint=FINGERPRINT   
--certificate-authorities=/cert.crt   
--fleet-server-cert=/fleet-cert.crt   
--fleet-server-cert-key=/fleet-server.key

But when i want to enroll my agent with the command on "add host" in fleet configuration, on other host, the command bellow stop with error : x509: certificate signed by unknown authority

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 13, 2023, 3:42pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/4 "2023-03-13T15:42:06Z")

</div>

> [@AbbysS](#):
>
> But when i want to enroll my agent with the command on "add host" in fleet configuration, on other host, the command bellow stop with error : x509: certificate signed by unknown authority

Apologies I am unclear what "add host" means So this is about installing and non-fleet / regular agent?

I think you can copy the CA to the host where the agent is and then use this, I am not sure if that is the Fleet CA or the Elasticsearch CA you could try both.

```auto
elastic-agent install --url <string>
                      --enrollment-token <string>
                      [--ca-sha256 <string>] < - This or Below 
                      [--certificate-authorities <string>] <!--- THIS I Think, but this is the CA 
                      [--delay-enroll]
                      [--force]
                      [--non-interactive]
                      [--help]
                      [--insecure]
                      [--tag <string>]
                      [global-flags]

```

---

<div class="post-metadata">

### Author: ![AbbysS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbyss/32/118389_2.png) [@AbbysS](https://discuss.elastic.co/u/AbbysS)
#### Post date: [March 13, 2023, 3:50pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/5 "2023-03-13T15:50:45Z")

</div>

I think i'm not clear, sorry.

I add my fleet server with quick start parameters.

1. My first try =\> I put my informations : Name and [https://MYIP:8220](https://MYIP:8220)  
Generate fleet server policy  
and install "fleet server to a centralized host"  
But when i install i see : "message":"Generating self-signed certificate for Fleet Server"  
And when i want to enroll agent into fleet : Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority  
For help, please see our troubleshooting guide at [Troubleshoot common problems | Fleet and Elastic Agent Guide [8.6] | Elastic](https://www.elastic.co/guide/en/fleet/8.6/fleet-troubleshooting.html)

2. Second try =\> So after i create my own certificates and run the command i show you before to install my fleet server.  
But when i try to enroll a new Agent in Fleet with my own certificates, the error is the same.

I don't know where is my mistake.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 13, 2023, 3:58pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/6 "2023-03-13T15:58:38Z")

</div>

> [@AbbysS](#):
>
> Second try =\> So after i create my own certificates and run the command i show you before to install my fleet server.  
> But when i try to enroll a new Agent in Fleet with my own certificates, the error is the same.

So when you enroll the actual agent are you using this?

And in including BOTH the elasticsearch CA and the Fleet CA?

Otherwise I think you are going to need to use the `--insecure`

Unless you use Official / Non-Self Managed Certs... perhaps I can try this myself in the next couple days...

```auto
elastic-agent install --url <string>
                      --enrollment-token <string>
                      [--ca-sha256 <string>] < - This or Below 
                      [--certificate-authorities <string>] <!--- THIS I Think, but this is the CA 
                      [--delay-enroll]
                      [--force]
                      [--non-interactive]
                      [--help]
                      [--insecure]
                      [--tag <string>]
                      [global-flags]

```

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 14, 2023, 3:10am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/7 "2023-03-14T03:10:49Z")

</div>

@AbbysS Yeah, I don't this you can do this with self-signed certs... you will need to install public certs or stick with the `--insecure` method...

I installed everything from scratch with self-signed certs and had to use the `--insecure` ....

 ![Screen Shot 2023-03-13 at 7.30.25 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7b1def85263adfca8ea40157fd1da4a01aafa36a.png)

---

<div class="post-metadata">

### Author: ![AbbysS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abbyss/32/118389_2.png) [@AbbysS](https://discuss.elastic.co/u/AbbysS)
#### Post date: [March 14, 2023, 8:47am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/8 "2023-03-14T08:47:46Z")

</div>

Hi,

Thanks for you reply,  
actually i'm not sure i use the best way to create elasticsearch CA and Fleet CA.  
I try to use this tutorial : [Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent Guide [8.6] | Elastic](https://www.elastic.co/guide/en/fleet/current/secure-connections.html)

But that don't work fine...

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 14, 2023, 1:48pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/9 "2023-03-14T13:48:51Z")

</div>

I just did this

> **[Deploy on-premises and self-managed | Fleet and Elastic Agent Guide \[8.6\] |...](https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html#add-fleet-server-on-prem-add-server)**

Took about 5 minutes, I did the quick start method, not advanced

Worked fine it created It's own certs and then I just use the --insecure flag for the agents

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 11, 2023, 1:49pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572/10 "2023-04-11T13:49:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.