Hi team how do I determine what certificate is provided to a

Question

Hi team how do I determine what certificate is provided to a client when enrolling to my FleetDM server When downloading the certificate from FleetDM it is a different certificate than what I have in my fleet config file and while both are valid I think it is causing an issue in the enrollment process

Mike S. · Answer

I think I ve got this sorted out sorry for the trouble However I am still having issues with the certificate verification during the enrollment process I m putting together some details

Mike S. · Answer

Request error certificate verify failed error I ve done the following troubleshooting Verified that the certificate on the server and the certificate on the client are the same by checking the SHA256 hash Both certs are in PEM format Verified that the server hostname matches the SAN in the certificate Ensured that the common name set in the TLS cert matches the FQDN of the server my flags file ` tls hostname=` Verified that the osquery flags file on the client has the tls server certs flag set and that the path to the cert is correct Verified that the cert itself is valid I am able to access our web GUI without any certificate error being issued Downloaded certificate from server using Advanced option under Add Hosts and used that in the enrollment process No change Sorry for the long post just running out of ideas

Mike S. · Answer

Here s the flags file if that helps tls hostname= lt FQDN removed gt tls server certs= opt orbit fleet pem Enrollment host identifier=instance enroll secret path= opt orbit secret txt enroll tls endpoint= api v1 osquery enroll Configuration config plugin=tls config tls endpoint= api v1 osquery config config refresh=10 Live query disable distributed=false distributed plugin=tls distributed interval=10 distributed tls max attempts=3 distributed tls read endpoint= api v1 osquery distributed read distributed tls write endpoint= api v1 osquery distributed write Logging logger plugin=tls logger tls endpoint= api v1 osquery log logger tls period=10 File carving disable carver=false carver start endpoint= api v1 osquery carve begin carver continue endpoint= api v1 osquery carve blocki carver block size=2000000

roberto · Answer

thanks so much for the details do you have access can share some of the logs <https fleetdm com docs using fleet orbit troubleshooting|here s where to find them > also can you share more details about how the enrollment process is failing that might also gives us a thread to pull

Mike S. · Answer

Thanks for your help So the enrollment process is failing in that the enrollment only partially completes for lack of a better explanation We see the host join Fleet in the GUI but there s no name no OS no identifying data It shows that it is online for around 1 minute and then goes offline

Kathy Satterlee · Answer

< Mike S > Can you generate a package with the ` debug` flag included That should give a more detailed error message

Kathy Satterlee · Answer

Thanks I ll be stepping away for the day due to internet issues annual Texas winter weather event strikes again and am sharing that with the team

Mike S. · Answer

No problem I appreciate all your team has done to help Stay safe out there