# X509: certificate signed by unknown authority

**URL:** <https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671>\
**Category:** Terraform\
**Created:** [May 12, 2020, 6:43pm UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671 "2020-05-12T18:43:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sharathmankala](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/sharathmankala/32/1475_2.png) [@sharathmankala](https://discuss.hashicorp.com/u/sharathmankala)\
**Post date:** [May 12, 2020, 6:43pm UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671/1 "2020-05-12T18:43:21Z")

</div>

Hi Team,

When i am trying to install eks cluster i am getting below error.  
can you help on this issue.  
Error: Post “[https://0964692BCB2AC7F55C5ABBDBC1DD6A70.gr7.us-east-1.eks.amazonaws.com/api/v1/namespaces/kube-system/configmaps](https://0964692BCB2AC7F55C5ABBDBC1DD6A70.gr7.us-east-1.eks.amazonaws.com/api/v1/namespaces/kube-system/configmaps)”: x509: certificate signed by unknown authority

on allow\_nodes.tf line 17, in resource “kubernetes\_config\_map” “aws\_auth”:  
17: resource “kubernetes\_config\_map” “aws\_auth” {

###############################allow\_nodes.tf###############

```auto
########################################################################################
# setup provider for kubernetes

data "external" "aws_iam_authenticator" {
  program = ["sh", "-c", "aws-iam-authenticator token -i example | jq-win64.exe -r -c .status"]
}

provider "kubernetes" {
  host = "${aws_eks_cluster.tf_eks.endpoint}"
  cluster_ca_certificate = "${base64decode(aws_eks_cluster.tf_eks.certificate_authority.0.data)}"
  token = "${data.external.aws_iam_authenticator.result.token}"
  load_config_file = false
  version = "~> 1.5"
}

# Allow worker nodes to join cluster via config map
resource "kubernetes_config_map" "aws_auth" {
  metadata {
    name = "aws-auth"
    namespace = "kube-system"
  }
  data = {
    mapRoles = <<EOF
- rolearn: ${aws_iam_role.tf-eks-node.arn}
  username: system:node:{{EC2PrivateDNSName}}
  groups:
    - system:bootstrappers
    - system:nodes
EOF
  }
  depends_on = [
    "aws_eks_cluster.tf_eks","aws_autoscaling_group.tf_eks" ]
}

```

---

<div class="post-metadata">

**Author:** ![syahdeini](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/syahdeini/32/14728_2.png) [@syahdeini](https://discuss.hashicorp.com/u/syahdeini)\
**Post date:** [November 16, 2020, 9:29am UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671/2 "2020-11-16T09:29:45Z")

</div>

I also need help from [@admins](https://discuss.hashicorp.com/groups/admins), I have the same problem with deployments and services.

```
Error: Failed to create deployment: Post "https://XXXXX.xx.region.eks.amazonaws.com/apis/apps/v1/namespaces/default/deployments": x509: certificate signed by unknown authority

  on main.tf line 117, in resource "kubernetes_deployment" "example":
 117: resource "kubernetes_deployment" "example" {

Error: Post 
"https://XXXXX.xxx.region.eks.amazonaws.com/api/v1/namespaces/default/services": x509: certificate signed by unknown authority

  on main.tf line 162, in resource "kubernetes_service" "example":
 162: resource "kubernetes_service" "example" {

Error: Post "https://xxxx.xxx.region.eks.amazonaws.com/api/v1/namespaces/kube-system/configmaps": x509: certificate signed by unknown authority

  on .terraform/modules/eks/aws_auth.tf line 64, in resource "kubernetes_config_map" "aws_auth":
  64: resource "kubernetes_config_map" "aws_auth" {
```

---

<div class="post-metadata">

**Author:** ![PatTheSilent](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/patthesilent/32/16604_2.png) [@PatTheSilent](https://discuss.hashicorp.com/u/PatTheSilent)\
**Post date:** [January 21, 2021, 9:22am UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671/3 "2021-01-21T09:22:03Z")

</div>

Did anyone manager to solve this? Just stumbled upon the same problem after recreating an EKS cluster…

---

<div class="post-metadata">

**Author:** ![vaishu98](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/vaishu98/32/15920_2.png) [@vaishu98](https://discuss.hashicorp.com/u/vaishu98)\
**Post date:** [January 21, 2021, 10:15am UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671/4 "2021-01-21T10:15:21Z")

</div>

Did you try refreshing the token?

---

<div class="post-metadata">

**Author:** ![PatTheSilent](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/patthesilent/32/16604_2.png) [@PatTheSilent](https://discuss.hashicorp.com/u/PatTheSilent)\
**Post date:** [January 27, 2021, 10:40am UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671/5 "2021-01-27T10:40:40Z")

</div>

In my case it was me being dumb and base64 encoding the CA cert instead of decoding…

---

<div class="post-metadata">

**Author:** ![nomeelnoj1](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/nomeelnoj1/32/7885_2.png) [@nomeelnoj1](https://discuss.hashicorp.com/u/nomeelnoj1)\
**Post date:** [February 21, 2021, 3:33am UTC](https://discuss.hashicorp.com/t/x509-certificate-signed-by-unknown-authority/8671/6 "2021-02-21T03:33:39Z")

</div>

Just ran into this as well, I believe this is the first time we have run updates on our clusters since upgrading to 0.14.5. The solution for us was a modification in the kubernetes provider block, but only for the first apply (even an empty apply will fix it).

We had to change from this:

```auto
provider "kubernetes" {
  token = data.aws_eks_cluster_auth.eks.token
  host = aws_eks_cluster.eks_cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks.certificate_authority.0.data)
}

```

To this:

```auto
provider "kubernetes" {
  token = data.aws_eks_cluster_auth.eks.token
  host = aws_eks_cluster.eks_cluster.endpoint
  insecure = true
  exec {
    api_version = "client.authentication.k8s.io/v1alpha1"
    args = ["eks", "get-token", "--cluster-name", var.cluster_name]
    command = "aws"
  }
}

```

Then we ran `terraform apply` and we were able to revert the config back to just using the data block to look up the token and certificate. Weird.

Hope this helps someone else!