Hello Happy hump day I am running fleet on Ubuntu 20 04 and

Question

Hello Happy hump day I am running fleet on Ubuntu 20 04 and have set it up according to On the same local network I am trying to add a host running MacOS Catalina OSQuery is confirmed to work locally on the mac via `osqueri` I can connect to the web interface from both machines I have the Enroll Secret on the mac in ` etc osquery enrollment secret` I have downloaded the server pem certificate onto the mac and copied it to ` var osquery server pem` also I have added it to the System in Keychain Access and set to Always Trust I am attempting to enroll from the mac with this command ```sudo osqueryd enroll secret path= etc osquery enrollment secret tls server certs= var osquery server pem tls hostname=192 168 1 115 8080 host identifier=elliott macbookpro enroll tls endpoint= api v1 osquery enroll config plugin=tls config tls endpoint= api v1 osquery config config refresh=10 disable distributed=false distributed plugin=tls distributed interval=3 distributed tls max attempts=3 distributed tls read endpoint= api v1 osquery distributed read distributed tls write endpoint= api v1 osquery distributed write logger plugin=tls logger tls endpoint= api v1 osquery log logger tls period=10``` When I run that I get the following error ```W1014 14 15 37 995653 377294272 tls enroll cpp 76 Failed enrollment request to Request error certificate verify failed retrying ``` The server stdout shows ```2020 10 14 14 15 37 http TLS handshake error from 192 168 1 104 54237 local error tls bad record MAC``` Any pointers as to how to get the handshake to succeed

sundsta · Answer

`bad record MAC` would indicate the data has been tampered with or corrupted in some way See <https github com googleapis google cloud go issues 1581 issuecomment 531817165>

E-Dawg · Answer

hmm so is it likely that Ubuntu is using a different version of TLS than the Mac

E-Dawg · Answer

I m sorry I m having trouble grasping the implications of that comment

E-Dawg · Answer

I m not sure what could be corrupting the data between 2 machines on my home network

kentd · Answer

MAC in this particular context probably refers to this part of the network stack <https en wikipedia org wiki Medium access control> and not your device What it implies is relatively well described in the issue that was linked in sundsta s response though what exactly causes this issue on your network is not something I ve got any idea about

E-Dawg · Answer

I wonder how I would find out sorry that I m such a noob

sundsta · Answer

Since the error is prefaced by `tls` it more likely refers to the TLS Message Authentication Code aka checksum See the `MAC` heading here <https www acunetix com blog articles tls ssl terminology basics part 3>

zwass · Answer

Another Fleet user reported fixing these issues by fixing the FQDN in the generated cert <https github com kolide fleet pull 2331 files>

ytonui · Answer

You also need to chain the certs ala <https waal70blog wordpress com 2017 02 15 create a self signed ssl certificate chain >