# Consul Certification **URL:** \ **Category:** Consul\ **Created:** [November 25, 2021, 12:33pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417 "2021-11-25T12:33:47Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![dimitar.manev](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dimitar.manev/32/24023_2.png) [@dimitar.manev](https://discuss.hashicorp.com/u/dimitar.manev)\ **Post date:** [November 25, 2021, 12:33pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/1 "2021-11-25T12:33:48Z")
Hello everyone. I need help by certification. I have 3 Servers and 1 Client and on the Server side i become the following error: **"agent.server.rpc: failed to read byte: conn=from= error="remote error: tls: bad certificate"** **Server Config :** { “server”: true, “bootstrap\_expect” : 3, “data\_dir”: “”, “client\_addr” :“0.0.0.0”, “datacenter”: “dc2”, “ui”: true, “ports” : { “https” : 8501, “http” : -1 }, “addresses”: { “http”: “0.0.0.0” }, “verify\_incoming”: false, “verify\_outgoing”: true, “verify\_server\_hostname”: true, “ca\_file”: “\_local.pem”, “cert\_file”: “\_local.pem”, “key\_file”: “.local.key”, “auto\_encrypt”: { “allow\_tls”: true }, “log\_level”: “INFO”, “disable\_update\_check”: true, “disable\_anonymous\_signature”: true } **Client Config:** { “server”: false, “data\_dir”: “”, “ui”: true, “retry\_join”: ["…", “…”, “…”], “bind\_addr”:“IpAddress (example)”, “datacenter”: “dc2”, “log\_level”: “INFO”, “ports”: { “http” : -1, “https” : 8501 }, “auto\_encrypt” :{ “tls” : true }, “disable\_update\_check”: true, “disable\_anonymous\_signature”: true, “verify\_outgoing”: true, “verify\_incoming”: false, “verify\_server\_hostname”: true, “ca\_file”: “\_local.pem” } What can i do to secure the consul cluster ? After using a https i cannot join members in cluster? Best regards ---
**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\ **Post date:** [November 25, 2021, 1:24pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/2 "2021-11-25T13:24:00Z")
You may want to start off by switching to HCL2, json has been deprecated. Also if you use the 3 backticks your code (there is a \<\> in the editor as well) is formatted properly so it’s readable to others. My suggestion is to backup and create a clean install, then add the gossip encryption, then enable tls after. Trying to jump to the end with all of it is probably more confusing. Just noticed, you don’t have an encryption key in your config too, that’s a required field for gossip encryption which you have turned on (half way: if you’re going to use encryption why not have it for both incoming/outgoing?). ---
**Author:** ![dimitar.manev](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dimitar.manev/32/24023_2.png) [@dimitar.manev](https://discuss.hashicorp.com/u/dimitar.manev)\ **Post date:** [November 25, 2021, 3:14pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/3 "2021-11-25T15:14:20Z")
Can you please copy my configuration and adjusting it . Tnx 🙂 I am new sorry ---
**Author:** ![karl-cardenas-coding](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/karl-cardenas-coding/32/19422_2.png) [@karl-cardenas-coding](https://discuss.hashicorp.com/u/karl-cardenas-coding)\ **Post date:** [November 29, 2021, 8:59pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/4 "2021-11-29T20:59:18Z")
@aram JSON is not deprecated and is a valid option for specifying configurations. ---
**Author:** ![karl-cardenas-coding](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/karl-cardenas-coding/32/19422_2.png) [@karl-cardenas-coding](https://discuss.hashicorp.com/u/karl-cardenas-coding)\ **Post date:** [November 29, 2021, 9:01pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/5 "2021-11-29T21:01:16Z")
@dimitar.manev How did you create the certificates? We have a [Learn tutorial](https://learn.hashicorp.com/tutorials/consul/tls-encryption-secure?in=consul/security) that walks you how to create certificates for Consul. ---
**Author:** ![dimitar.manev](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dimitar.manev/32/24023_2.png) [@dimitar.manev](https://discuss.hashicorp.com/u/dimitar.manev)\ **Post date:** [December 1, 2021, 9:46am UTC](https://discuss.hashicorp.com/t/consul-certification/32417/6 "2021-12-01T09:46:48Z")
Hi Karl . We have our CA Certificates and they work … but now i have a problem. I have gossip encryption , i have a acl enabling and i have certificates… now i can not join the cluster ERROR: Error joining address "’: Unexpected response code: 403 (Permission denied) ---
**Author:** ![karl-cardenas-coding](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/karl-cardenas-coding/32/19422_2.png) [@karl-cardenas-coding](https://discuss.hashicorp.com/u/karl-cardenas-coding)\ **Post date:** [December 1, 2021, 3:21pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/7 "2021-12-01T15:21:29Z")
What permissions does this ACL token have ? ---
**Author:** ![dimitar.manev](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/dimitar.manev/32/24023_2.png) [@dimitar.manev](https://discuss.hashicorp.com/u/dimitar.manev)\ **Post date:** [December 1, 2021, 3:23pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/8 "2021-12-01T15:23:14Z")
the basic permissions from Consul example . i’ve just made “consul acl bootstrap” and i have acl’s enabled… ---
**Author:** ![karl-cardenas-coding](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/karl-cardenas-coding/32/19422_2.png) [@karl-cardenas-coding](https://discuss.hashicorp.com/u/karl-cardenas-coding)\ **Post date:** [December 1, 2021, 3:26pm UTC](https://discuss.hashicorp.com/t/consul-certification/32417/9 "2021-12-01T15:26:05Z")
So when you say it cannot join the cluster, is that referring to the servers or a client ? The other question I have is, did you set the token value to the agent `consul acl set-agent-token agent `