@flaviodomingos the TLS endpoint is the key, as you've already found. We were dealing with the same type of issue and are working on some ideas for a more cloud(ok fine, aws) based solution but one way or another you either need to have a TLS server, or be able to run chef/saltstack/jamf/etc on all endpoints if you're going to be using a file-based config