Hi all - I've been running into this issue - https://github.com/fleetdm/fleet/issues/8729 on multiple hosts. The odd thing (to me, at least) is that in the Fleet UI, I can run "select result from curl where url = 'https://api.ipify.org';" on my test host and get a result, but when attempting the query via orbit shell on the test host I get no result (it mirrors the "actual behavior" in the link). Based on the comments in the link, I would assume the certs used for the connection would be the same in the Fleet UI and Orbit shell, is that accurate? I also wanted to see if any workarounds have been devised for this?

Hey @Mike S. ! It’s not entirely surprising that you’re seeing different behavior in Fleet vs the shell as they aren’t running with the same flags.

Hi @Kathy Satterlee! So they would use different certificates?

Yes, we see all kinds of weird "gotchas" when testing things with the shell vs through live queries. It does sound like the root of the issue is solidly that osquery bug though!

Interesting! Thank you for the info!