---
title: Fleet Server client certificate authentication on ECK
description: Fleet Server can be configured to require client certificates from connecting Elastic Agents, providing mutual TLS (mTLS) on the Elastic Agent-to-Fleet...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7590/deploy-manage/security/k8s-fleet-server-client-certificate-auth
products:
  - Elastic Cloud on Kubernetes
applies_to:
  - Elastic Cloud on Kubernetes: Planned
---

# Fleet Server client certificate authentication on ECK
Fleet Server can be configured to require client certificates from connecting Elastic Agents, providing mutual TLS (mTLS) on the Elastic Agent-to-Fleet Server connection. This is independent of, and can be combined with, [Elasticsearch client certificate authentication](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7590/deploy-manage/security/k8s-es-client-certificate-auth).
<note>
  - This requires a valid Enterprise license or Enterprise trial license. Check [the license documentation](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7590/deploy-manage/license/manage-your-license-in-eck) for more details about managing licenses.
  - Fleet Server client certificate authentication requires one of the following Fleet Server versions: 8.19.19+, 9.3.8+, 9.4.4+, or 9.5.0+.
</note>


## Enable client authentication

Set `spec.http.tls.client.authentication` to `true` on the Fleet Server Agent resource:
```yaml
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
  name: fleet-server
spec:
  version: 9.4.4
  mode: fleet
  fleetServerEnabled: true
  http:
    tls:
      client:
        authentication: true
```

When enabled, ECK does the following:
- Sets the `FLEET_SERVER_CLIENT_AUTH` environment variable to `required` on Fleet Server pods.
- Automatically generates and manages client certificates for the Fleet Server's internal Elastic Agent process and for all Elastic Agents that reference this Fleet Server.

Connecting Elastic Agents require no additional configuration — ECK manages the full certificate lifecycle automatically.
<note>
  If you have manually set `FLEET_SERVER_CLIENT_AUTH` in the pod template, that value takes precedence over the ECK-managed setting and the mTLS configuration may not apply as expected.
</note>


## Use a custom client certificate for an Elastic Agent

To provide your own client certificate for an Elastic Agent connecting to a Fleet Server with client authentication enabled, set `clientCertificateSecretName` in the `fleetServerRef`. When you provide a custom certificate, ECK automatically configures Fleet Server to trust it — no additional trust configuration is required.
```yaml
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
  name: elastic-agent
spec:
  version: 9.4.4
  mode: fleet
  fleetServerRef:
    name: fleet-server
    clientCertificateSecretName: my-custom-client-cert
```

The referenced secret must contain `tls.crt` and `tls.key` entries:
```yaml
apiVersion: v1
kind: Secret
metadata:
  name: my-custom-client-cert
type: kubernetes.io/tls
data:
  tls.crt: <base64-encoded certificate>
  tls.key: <base64-encoded private key>
```

<note>
  - The secret must be in the same namespace as the resource that references it.
  - All components are compatible with PKCS#8 private keys. If you supply a certificate in a different format, verify compatibility with Fleet Server and Elastic Agent before use.
</note>


## Disable client authentication on Fleet Server

To turn off client authentication, set `spec.http.tls.client.authentication` to `false` or remove it from the Fleet Server Agent resource:
```yaml
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
  name: fleet-server
spec:
  http:
    tls:
      client:
        authentication: false
```

ECK handles the transition gracefully.