\o/ osctrl newbie here... Tried deploying osctrl on an ubuntu 22.04 machine for testing purposes using the docker compose approach following README instructions. The same node doesn't successfully enrol and I'm seeing a certificate verify failed error. Logs below:

osctrl-osquery-1-dev | I1217 07:07:29.681427     8 smbios_tables.cpp:253] Could not read SMBIOS memory
osctrl-osquery-3-dev | I1217 07:07:29.695061     9 smbios_tables.cpp:253] Could not read SMBIOS memory
osctrl-osquery-3-dev | I1217 07:07:29.696940     9 tls.cpp:263] TLS/HTTPS POST request to URI: <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll>
osctrl-osquery-1-dev | I1217 07:07:29.700807     8 tls.cpp:263] TLS/HTTPS POST request to URI: <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll>
osctrl-osquery-3-dev | W1217 07:07:29.755970     9 tls_enroll.cpp:101] Failed enrollment request to <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll> (Request error: certificate verify failed) retrying...
osctrl-osquery-1-dev | W1217 07:07:29.761394     8 tls_enroll.cpp:101] Failed enrollment request to <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll> (Request error: certificate verify failed) retrying...
osctrl-osquery-3-dev | I1217 07:07:45.756908     9 smbios_tables.cpp:253] Could not read SMBIOS memory
osctrl-osquery-1-dev | I1217 07:07:45.762305     8 smbios_tables.cpp:253] Could not read SMBIOS memory
osctrl-osquery-1-dev | I1217 07:07:45.764082     8 tls.cpp:263] TLS/HTTPS POST request to URI: <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll>
osctrl-osquery-3-dev | I1217 07:07:45.776799     9 tls.cpp:263] TLS/HTTPS POST request to URI: <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll>
osctrl-osquery-1-dev | W1217 07:07:45.790889     8 tls_enroll.cpp:101] Failed enrollment request to <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll> (Request error: certificate verify failed) retrying...
osctrl-osquery-3-dev | W1217 07:07:45.819334     9 tls_enroll.cpp:101] Failed enrollment request to <https://osctrl-nginx/2f8ad0c8-b6a2-46d9-ad4d-bcfcdfd5d42c/enroll> (Request error: certificate verify failed) retrying...

Is there a way to disable TLS on the osctrl server so I can get the node to enrol properly? I guess this has something to do with the subjAltNames or CN on the cert I generated, but I've tried different options on the openssl.cnf file including adding the IP of the node to the alt_names, directly specifying the IP on the CN, etc. No luck though. I'll next try to enrol from another machine with the

--tls_dump

flag, but wanted to first pick your brains for a workaround here. Thanks!

I haven't personally used osctrl, maybe try #CHCLHJH7X? I agree, that sounds like osctrl is expecting a client cert for enrollment