My osquery doesnot connect to the fleet when i have my netskope turned on. if i turn it off then i see the host online. It throws certificate verification failed error. Any help on it? FYI Curl command works just fine even if netskope is on.

are you specifying your wildcard cert explicitly in the osquery flags (or orbit package options?)

Sounds like maybe netskope is man-in-the-middling your TLS? Do you need to provide netskope's certificate to osquery?

@Jason no i am not providing anything in osquery flag file i just pickup the query from fleet and create the package.

You need to either use a certificate that is recognized by the built in cert bundle, or you need to provide it to osquery for validation.

to osquery you mean when creating agent? or in the fleet server somewhere?

Are you using Orbit or regular osquery?

orbit

AWS certificates definitely work with the built-in certificate in Orbit, so you can leave

--fleet-certificate

empty when creating packages. If you did specify

--fleet-certificate

, you need to make sure the certificate doesn't change (or is still trusted by the cert chain you provide to that flag). If it only works when netskope is off, I assume that's because netskope is MITMing your TLS traffic and using a different certificate that doesn't verify.

fleetctl package --type=pkg --fleet-url=https://fleetnew.tpsec.co --enroll-secret=* i dont specify fleet cert at all. this is what i use. Also it works when i use the insecure package. So what if i stick to insecure how much harm can that do?

If you use

--insecure

then your agents could be communicating with any server, because it skips the certificate validation. Definitely do not recommend for production.

Alright so my only option is to specify the netskop cert but is there any way i can specify a cert without building new agents and installing them? like can i keep the old agents and update them to use cert :?

If you have some way to overwrite the files, you could write the appropriate certificates to

/opt/orbit/certs.pem

.

thanks for your time @zwass let me try it our