when I m trying to connect osquery agent to fleet I get that

Question

when I m trying to connect osquery agent to fleet I get that error msg W0803 08 45 50 922413 77924 tls enroll cpp 101 Failed enrollment request to <https localhost 8080 api osquery enroll> Request error certificate verify failed retrying it happens after i run that command sudo usr bin osqueryd enroll secret path= var osquery enroll secret tls server certs= var osquery fleet pem tls hostname=localhost 8080 host identifier=instance enroll tls endpoint= api osquery enroll config plugin=tls config tls endpoint= api osquery config config refresh=10 disable distributed=false distributed plugin=tls distributed interval=3 distributed tls max attempts=3 distributed tls read endpoint= api osquery distributed read distributed tls write endpoint= api osquery distributed write logger plugin=tls logger tls endpoint= api osquery log logger tls period=10 its fleet 3 5 1 if it matters

Kathy Satterlee · Answer

Hi < peanut butter> Are you still having trouble getting your host enrolled

peanut butter · Answer

yes

Kathy Satterlee · Answer

Are you seeing anything in the fleet server logs when attempting to enroll

Kathy Satterlee · Answer

Here s some info on common certificate issues that may be helpful as well <https fleetdm com docs deploying faq how do i fix certificate verify failed errors from osqueryd|https fleetdm com docs deploying faq how do i fix certificate verify failed errors from osqueryd>

peanut butter · Answer

im getting that log from the the fleet service http TLS handshake error from 127 0 0 1 33022 local error tls bad record MAC

Kathy Satterlee · Answer

Okay The request is at least making it that far Sounds like there s an issue with the certificate Did you generate that yourself for localhost

peanut butter · Answer

im doing this by your example openssl req x509 newkey rsa 4096 sha256 days 3650 nodes keyout tmp server key out tmp server cert subj CN=192 168 52 128 addext subjectAltName=DNS 192 168 52 128 and the other certificate I downlowd form the my fleet webserver

Kathy Satterlee · Answer

Ah Try listing the IP as listed for the CN as the hostname

peanut butter · Answer

what do you mean

Kathy Satterlee · Answer

The certificate is being issued using an IP address of 192 168 52 128 as the CN Common Name Assuming that is the public IP of your Fleet server that s what you d need to use as the hostname passed to osquery

Kathy Satterlee · Answer

Or create a new certificate with localhost as the CN if you re just testing locally

peanut butter · Answer

<https osquery slack com archives C01DXJL16D8 p1660067147489909 thread ts=1659541736 396929 amp cid=C01DXJL16D8> i already tried it