I need to deploy Fleet behind my firewall. I believe I will need to change the Fleet IP to a domain like Fleet1.sample.com and update the certificates to reflect the new domain for outside nodes to connect. Does anybody have instructions on how to do this. I can do a new install of Fleet if I have to.

In Fleet, you can just replace the existing Cert file, update the appropriate configuration flags if the path or filename changed, and restart the server. For your osquery agents, If the both the existing and new certificates verify with osquery's default root certificates (such as a certificate issued by a well-known Certificate Authority) and no certificate chain was deployed with osquery, there is no need to deploy a new certificate chain. If osquery has been deployed with the full certificate chain (using

--tls_server_certs

), deploying a new certificate chain is necessary to allow for verification of the new certificate. Deploying a certificate chain cannot be done centrally from Fleet.