> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/the-tracer-in-enginsight-shows-a-certificate-error-and-does-not-connect-what-can-i-do.md).

# The Tracer in Enginsight shows a certificate error and does not connect. What can I do?

If you are using a self-signed certificate or a Windows PKI (Public Key Infrastructure), or if error messages such as the following are shown in the Tracer log:

> manager.py:468: failed connecting to wss\://\<URL>/v1/traicer due to \[SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed: self-signed certificate in certificate chain (\_ssl.c:1000). Retrying in 0:00:12

or

> failed connecting to wss\:///v1/traicer due to \[SSL: CERTIFICATE\_VERIFY\_FAILED] certificate verify failed: unable to get local issuer certificate (\_ssl.c:1010). Retrying in 0:01:00

you can check the following to resolve the issue.

***

## Checking the Tracer Version

The SIEM component Tracer must be running **at least version 0.0.3**. Follow these steps to check the version:

{% stepper %}
{% step %}

### Open the Docker configuration file

1. Log in to the server on which the Tracer is installed. This is usually the **SIEM Management Server**, but it may also be a separate server.
2. Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

2. Open the **Docker configuration file** using the following command:

```
sudo nano docker-compose.yml
```

{% endstep %}

{% step %}

### Get the Tracer version

Navigate to the Docker container `traicer`. The currently installed Tracer version is specified here as follows:

```
traicer:
  image: registry.enginsight.com/enginsight/traicer-m50:<CurrentTracerVersion>
```

{% endstep %}

{% step %}

### Optional: Update the Tracer

If the version is not at least `0.0.3`, you must update the Tracer by updating the Enginsight SIEM.

{% hint style="success" icon="lightbulb" %}
For more information on how to update the Enginsight SIEM, see the Enginsight Manual: [Updates | Enginsight SIEM](https://docs.enginsight.com/docs/manual/english/installation-und-konfiguration/updates/enginsight-siem)
{% endhint %}
{% endstep %}
{% endstepper %}

***

## Checking that the Certificate Chain Is Complete

Check whether the **complete certificate chain** (root certificate, intermediate certificate, and server certificate) is available in the **PEM format** and is **Base64 encoded**.

***

## Checking Certificate Availability

Check whether the root certificate has been correctly stored and trusted on the SIEM Management Server.

{% hint style="success" icon="lightbulb" %}
For more information on how to store and configure a self-signed certificate in Enginsight, see the Knowledge Base: [How do I store and configure a self-signed SSL/TLS certificate in Enginsight?](/docs/knowledge-base/english/configuration/how-do-i-store-and-configure-a-self-signed-ssl-tls-certificate-in-enginsight.md)
{% endhint %}

You must also explicitly make the certificate available in the Docker container for the Tracer if this has not already been done. Follow these steps:

{% stepper %}
{% step %}

### Open the Docker configuration file

1. Log in to the server on which the Tracer is installed. This is usually the **SIEM Management Server**, but it may also be a separate server.
2. Navigate to the Enginsight installation directory using the following command:

```
cd /opt/enginsight/enterprise
```

2. Open the **Docker configuration file** using the following command:

```
sudo nano docker-compose.yml
```

{% endstep %}

{% step %}

### Adjust the Docker configuration file

1. In the Docker configuration file, navigate to the `traicer` section and add the following to make the certificate available in the Docker container:

<pre><code>traicer:
  image: registry.enginsight.com/enginsight/traicer-m50:&#x3C;CurrentTracerVersion>
  restart: always
  volumes:
    - /var/traicer/data:/traicer/data
<strong>    - &#x3C;PathToCertificateFile>:/etc/ssl/cert.pem
</strong>  environment:
<strong>    ADDRESS: 'wss://&#x3C;URL>/v1/traicer'
</strong>    BASIC_AUTH_USER: '&#x3C;Username>'
    BASIC_AUTH_PASSWORD: '&#x3C;Password>'
<strong>    EXTRA_CA_CERTS: /etc/ssl/cert.pem
</strong></code></pre>

{% hint style="info" %}
Remember to replace `<PathToCertificateFile>` accordingly. Also make sure that the `ADDRESS` environment variable does not contain a duplicate **https\://**.
{% endhint %}

2. Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
   {% endstep %}

{% step %}

### Restart the Docker container

Now restart the Docker containers using the following command to apply the changes:

```
sudo docker compose up -d
```

{% endstep %}
{% endstepper %}

***