# Error: "tls: bad certificate" when using a self-signed certificate **URL:** \ **Category:** Vault\ **Created:** [October 5, 2021, 4:55pm UTC](https://discuss.hashicorp.com/t/error-tls-bad-certificate-when-using-a-self-signed-certificate/30295 "2021-10-05T16:55:20Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![danben](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/danben/32/22791_2.png) [@danben](https://discuss.hashicorp.com/u/danben)\ **Post date:** [October 5, 2021, 4:55pm UTC](https://discuss.hashicorp.com/t/error-tls-bad-certificate-when-using-a-self-signed-certificate/30295/1 "2021-10-05T16:55:20Z")
I followed the instructions [here](https://groups.google.com/g/vault-tool/c/DPLA6y4kh0U/m/CJ9qKaPiMQUJ) to set up a vault with a self-signed certificate and am getting this error when attempting to log in. Could anyone suggest possible causes and/or things I might check? I’m not sure exactly what other details to provide, but I’m trying to log in from the same server on which the vault is running, and I’m using [https://127.0.0.1:8200](https://127.0.0.1:8200) as my vault\_addr. ---
**Author:** ![jeffsanicola](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffsanicola/32/18651_2.png) [@jeffsanicola](https://discuss.hashicorp.com/u/jeffsanicola)\ **Post date:** [October 5, 2021, 5:53pm UTC](https://discuss.hashicorp.com/t/error-tls-bad-certificate-when-using-a-self-signed-certificate/30295/2 "2021-10-05T17:53:51Z")
Those instructions are quite dated. One thing that jumps out to me is that Go, if I’m remembering correctly, dropped support for the `CN` attribute in the CSR template a while back and you need to include your subject in the SANs list only. I’m not sure this will address your issue but is worth a try to eliminate a potential issue. Alternatively, HashiCorp’s guide might be a better one to follow as it’s probably a bit more with the times as a lot has changed since 2015 (~ Vault v0.4.0): [Vault with Integrated Storage Deployment Guide | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/raft-deployment-guide#prepare-tls-certificates) Edit: CN was deprecated in Go 1.15 [Go 1.15 Release Notes - The Go Programming Language](https://golang.org/doc/go1.15#commonname) which means it impacts Vault 1.6.0 and newer: [vault/CHANGELOG.md at main · hashicorp/vault · GitHub](https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#160) ---
**Author:** ![danben](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/danben/32/22791_2.png) [@danben](https://discuss.hashicorp.com/u/danben)\ **Post date:** [October 5, 2021, 10:09pm UTC](https://discuss.hashicorp.com/t/error-tls-bad-certificate-when-using-a-self-signed-certificate/30295/3 "2021-10-05T22:09:44Z")
Thanks, Jeff. I tried to follow the instructions there, which told me that I should be able to use a certificate / key generated as part of installation. That didn’t work because I need SANs, so I regenerated my certificate and now I’m getting “certificate signed by unknown authority”, which I thought I had solved before by adding CA:TRUE to basicConstraints. Not quite sure where to go from here, in case you have any other thoughts. ---
**Author:** ![danben](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/danben/32/22791_2.png) [@danben](https://discuss.hashicorp.com/u/danben)\ **Post date:** [October 5, 2021, 10:21pm UTC](https://discuss.hashicorp.com/t/error-tls-bad-certificate-when-using-a-self-signed-certificate/30295/4 "2021-10-05T22:21:03Z")
Using -tls-skip-verify got me past this. Hopefully this is a reasonable thing to do on internal servers. ---
**Author:** ![aram](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@aram](https://discuss.hashicorp.com/u/aram)\ **Post date:** [October 6, 2021, 9:17am UTC](https://discuss.hashicorp.com/t/error-tls-bad-certificate-when-using-a-self-signed-certificate/30295/5 "2021-10-06T09:17:28Z")
You don’t have much choice, if you want the cert to be checked (which really it should be) then you either need to run your own CA (PKI/PKI Int within Vault) and distribute the cert to each of the clients. Or you need to go an outside to someone like letsencrypt to get a cert that would be verifiable. We go with the self-hosted-CA but your mileage may vary depending on how easy it is to distribute the CA cert.