Unable to import ssh certificate

teleport
#1

hi .
my platform is ec2 + lb +acm.

I can run tsh login succeed but I can not import ssh certificate by tsh.
I have run the teleport in --insecure mode

  ./tsh login --proxy=teleport-domain:443 --user leo
Enter password for Teleport user leo:
Please press the button on your U2F key
> Profile URL:  https://teleport-domain:3080
  Logged in as: leo
  Cluster:      teleport-domain
  Roles:        admin*
  Logins:       ec2-user
  Valid until:  2019-08-20 04:33:55 +0800 CST [valid for 12h0m0s]
  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty

  Profile URL:  https://172.21.42.17:3080
  Logged in as: leo1
  Cluster:      172.21.42.17
  Roles:        admin*
  Logins:       ec2-user
  Valid until:  2019-08-17 06:20:10 +0800 CST [EXPIRED]
  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty

  Profile URL:  https://3.112.198.179:3080
  Logged in as: leo
  Cluster:      3.112.198.179
  Roles:        admin*
  Logins:       ec2-user
  Valid until:  2019-08-17 06:43:09 +0800 CST [EXPIRED]
  Extensions:   permit-agent-forwarding, permit-port-forwarding, permit-pty


* RBAC is only available in Teleport Enterprise
  https://gravitational.com/teleport/docs/enterprise

./tsh login --proxy=teleport-domain --out=key  --format=openssh
Enter password for Teleport user leo:
Please press the button on your U2F key
error: Get https://teleport.cluster.local/v2/authorities/host?load_keys=false: x509: certificate signed by unknown authority
#2 
x509: certificate signed by unknown authority

Usually happens when there is a load balancer terminating connections in front of your Auth server. Auth server (port 3025) requires NLB or any other load balancer that does not terminate TLS, because Auth server uses it’s own certificate.