the likely problem is that @Ed did not configure fleet to use the tls hostname to be the same as where the cert is served from (the external URL fleet should be riched via)

So the hostname for the box i was running fleet on was kolide. I had set the url to be https://kolide:443. Obviously this isn't correct, what should the url be set to?