if creating a fleet-osquery.pkg for mac using fleetctl do the certs from the server need to be deployed separately to the client and location specificed with

--fleet-certificate

or do those get downloaded and bundled in during package creation by default?

@mason kemmerer by default, the fleet certificate is included in the

package

command. You can always download it separately under the "Advanced" tab in the UI when you are creating new hosts.

so i downloaded fleet.pem from the fleet webui and specified that in the path and that finally enrolled my host... it didnt seem to work without it... any thoughts?

yup, the .pem includes the full certificate chain

thx will try that and update my docs! just happy to have something working