Afternoon Everyone Looking for some help plz I m trying to b

Question

Afternoon Everyone Looking for some help plz I m trying to build my Kolide stack I cannot work with my certificates Am getting W0714 16 29 21 859051 135417856 tls cpp 100 Cannot read TLS server certificate s ~ Desktop OSQueryTmp cert pem W0714 16 29 21 926555 135417856 tls enroll cpp 76 Failed enrollment request to lt lt Domain gt gt Request error certificate verify failed retrying

Ryan · Answer

I had something similar to this when first setting up Fleet which was because I needed to have the full certificate chain in the pem file Once I provided the full chain all intermediate certificates and the root certificate it all started working again

J Gilmour · Answer

Believe I ve got the full chain in my pem file on my local machine

Ryan · Answer

is it a self signed cert

J Gilmour · Answer

letsencrypt

Ryan · Answer

you may need to include Let s Encrypt s root cert at the end of the PEM too

Ryan · Answer

I m not sure though

J Gilmour · Answer

when running openssl s client connect against my hostname comes back with

J Gilmour · Answer

SSL handshake has read 3127 bytes and written 401 bytes Verification error unable to get local issuer certificate New TLSv1 3 Cipher is TLS AES 128 GCM SHA256 Server public key is 2048 bit Secure Renegotiation IS NOT supported Compression NONE Expansion NONE No ALPN negotiated Early data was not sent Verify return code 20 unable to get local issuer certificate

J Gilmour · Answer

not sure if this has something to do with it

Ryan · Answer

yeah that suggests it s not able to verify the full trust chain

Ryan · Answer

you could try appending the X3 intermediate cert and the X1 root cert for Let s Encrypt to your pem file and see if that does the trick <https letsencrypt org certificates >

J Gilmour · Answer

Appending <https letsencrypt org certs lets encrypt x3 cross signed pem txt> to the bottom of my MacBook does nothing

J Gilmour · Answer

Fleet Server running in AWS MacBook running locally

Ryan · Answer

add the X1 as well so you have the entire chain

Ryan · Answer

you ll probably need to restart the osquery service too

Ryan · Answer

I d also check if you can the usual things like if you can reach Fleet via curl etc

J Gilmour · Answer

can do all of that etc

Ryan · Answer

I haven t rolled it out on macOS myself so I m not sure my experience was various Linux distros

J Gilmour · Answer

Not enjoying this tbh

Ryan · Answer

to rule out the cert you might try doing an initial proof of concept with a self signed cert than it s just a single cert shouldn t be much to go wrong smile

J Gilmour · Answer

true dat

J Gilmour · Answer

if this doesn t work Might try that

Ryan · Answer

crossed fingers

Ryan · Answer

worked for me joy

J Gilmour · Answer

I need a certificate on this my Macs are not managed through a core VPN

J Gilmour · Answer

Nah didn t work

Ryan · Answer

when I went to productionise it I switched to a wildcard certificate and that s when I hit this issue and needed the intermediate and root certs appending to the PEM

Ryan · Answer

could be macOS is different here though I haven t tried it on a Mac yet

J Gilmour · Answer

Nah even with a Self signed cert doesn t want to play ball

J Gilmour · Answer

Let me check AWS Settings

J Gilmour · Answer

< Ryan> So I think that because I setup an ACM in AWS with my DNS Entry that may have done it

J Gilmour · Answer

I ll need to refresh my DNS Cache

Ryan · Answer

ahh interesting

Ryan · Answer

I ve not used ACM

J Gilmour · Answer

I ll give it ago shortly Thanks again