https://github.com/osquery/osquery logo
Join Slack
Powered by
HI ，I have deployed fleet and downloaded the clien...
# fleet
j
HI ，I have deployed fleet and downloaded the client through orbit for installation, but the server reports an error, which seems to be a problem with the certificate. Is there a problem with my certificate creation? @zwass
k
It looks like you generated the certificate using your domain name, but used the IP address as the Fleet server address when generating your installer package. Since that address is not included in the certificate, it cannot be validated. You can either add the IP address to the cert, or generate a new package using the domain name.
j
If I want to use IP as the access address, should the command for certificate creation be changed to this
Copy code
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
  -keyout /tmp/server.key -out /tmp/server.cert -subj "/CN=10.32.249.101" \
  -addext "subjectAltName=IP:10.32.249.101"
I redeployed the certificate according to the following command：
Copy code
openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
-keyout /tmp/server.key -out /tmp/server.cert
The osquery client was regenerated through orbit and deployed, and the fleet background can display the client, but I saw some errors in the information on the service
Another question is, where are our fleet logs stored by default?
k
Fleet uses 
stdout
and 
stderr
for logging. By default, that means that the logs will show up in the terminal where Fleet is running. What are you seeing for the osquery logs for the host?
Is this a dev environment? If so, you can save a lot of headache around self-signed certificates by using the 
--insecure
flag when setting up your installer packages. That will allow Orbit to act as a proxy between osquery and Fleet.
2 Views
Open in Slack
PreviousNext
Powered by