my personal suggestion is to ONLY configure osqueryd to talk to your TLS server and then have all other osqueryd configurations delivered by the server via the configuration’s top level “options” key