# Error: failed to create secret Post "https://192.168.1.2:6443/api/v1/namespaces/default/secrets?fieldManager=kubectl-create&fieldValidation=Strict": tls: failed to verify certificate: x509: certificate signed by unknown authority

**URL:** <https://discuss.kubernetes.io/t/error-failed-to-create-secret-post-https-192-168-1-2-6443-api-v1-namespaces-default-secrets-fieldmanager-kubectl-create-fieldvalidation-strict-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/26926>\
**Category:** General Discussions\
**Tags:** development\
**Created:** [February 1, 2024, 4:13pm UTC](https://discuss.kubernetes.io/t/error-failed-to-create-secret-post-https-192-168-1-2-6443-api-v1-namespaces-default-secrets-fieldmanager-kubectl-create-fieldvalidation-strict-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/26926 "2024-02-01T16:13:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![estem](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/estem/32/14169_2.png) [@estem](https://discuss.kubernetes.io/u/estem)\
**Post date:** [February 1, 2024, 4:13pm UTC](https://discuss.kubernetes.io/t/error-failed-to-create-secret-post-https-192-168-1-2-6443-api-v1-namespaces-default-secrets-fieldmanager-kubectl-create-fieldvalidation-strict-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/26926/1 "2024-02-01T16:13:47Z")

</div>

Hi,

while i’m createting a secret :

`sudo kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json --type=kubernetes.io/dockerconfigjson --server=https://192.168.1.2:6443`

I got this error :

`error: failed to create secret Post "https://192.168.1.2:6443/api/v1/namespaces/default/secrets?fieldManager=kubectl-create&fieldValidation=Strict": tls: failed to verify certificate: x509: certificate signed by unknown authority`

k config view

```auto
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.1.2:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED

```

could anyone help please ?

---

<div class="post-metadata">

**Author:** ![timwolfe94022](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/timwolfe94022/32/14319_2.png) [@timwolfe94022](https://discuss.kubernetes.io/u/timwolfe94022)\
**Post date:** [February 4, 2024, 4:49am UTC](https://discuss.kubernetes.io/t/error-failed-to-create-secret-post-https-192-168-1-2-6443-api-v1-namespaces-default-secrets-fieldmanager-kubectl-create-fieldvalidation-strict-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/26926/2 "2024-02-04T04:49:39Z")

</div>

[Google DeepMind Assisted Answer]

The error you’re encountering, “tls: failed to verify certificate: x509: certificate signed by unknown authority”, typically indicates that the Kubernetes client (kubectl) is unable to trust the certificate presented by your Kubernetes API server at [https://192.168.1.2:6443](https://192.168.1.2:6443). This can happen for a few reasons, but it’s usually because the certificate authority (CA) that issued the API server’s certificate isn’t trusted by your system or is not correctly specified in your Kubernetes configuration.

Given the information from your kubectl config view output, it seems that the Kubernetes cluster configuration does include a certificate authority data (certificate-authority-data), which should be used to verify the API server’s certificate. However, the error suggests that this verification isn’t happening successfully.

Here are some steps you can take to troubleshoot and potentially resolve this issue:

```
1.	Verify Certificate Authority (CA): Ensure that the CA data in your Kubernetes configuration (certificate-authority-data) matches the CA that issued the API server’s certificate. If you have access to the CA certificate, you can compare it with the certificate-authority-data in your Kubernetes config file.
2.	Update CA Certificates on Your System: If the CA used by your Kubernetes cluster is supposed to be trusted system-wide, ensure it’s added to your system’s trusted CA store. The process for this varies depending on your operating system.
3.	Skip TLS Verification (Not Recommended for Production): For testing purposes or in a trusted network environment, you can temporarily bypass the TLS verification by setting the insecure-skip-tls-verify: true flag in your Kubernetes configuration under the cluster section. Remember, this is not recommended for production environments as it bypasses important security checks:

```

clusters:

- cluster:  
insecure-skip-tls-verify: true  
server: [https://192.168.1.2:6443](https://192.168.1.2:6443)  
name: kubernetes

If these steps do not resolve your issue, it might be helpful to provide more context or check the logs of the Kubernetes API server (if accessible) for more specific errors related to the TLS handshake or certificate verification process.