Need some noobie help I0412 14 08 38 742949 11449 tls cpp 25

Question

Need some noobie help I0412 14 08 38 742949 11449 tls cpp 253 TLS HTTPS POST request to URI W0412 14 08 38 750748 11449 tls enroll cpp 76 Failed enrollment request to Request error certificate verify failed retrying Any advice

SK · Answer

You will need to put the whole cert chain in the cert file for the OSQuery agent

xiaoliuzi · Answer

I am a newbie how to put the whole cert chain in the cert file for the OSQuery agent

SK · Answer

< xiaoliuzi>Did you fix it already Just saw your message

xiaoliuzi · Answer

no no no I do not fix it What method do you have

SK · Answer

You will need to put the whole cert chain in the cert file for the osquery agent to work

xiaoliuzi · Answer

The server pem and enroll secret

xiaoliuzi · Answer

I use this

xiaoliuzi · Answer

sudo osqueryd enroll secret path= var osquery enroll secret tls server certs= var osquery server pem tls hostname=192 168 10 101 8080 host identifier=192 168 10 103 enroll tls endpoint= api v1 osquery enroll config plugin=tls config tls endpoint= api v1 osquery config config refresh=10 disable distributed=false distributed plugin=tls distributed interval=10 distributed tls max attempts=3 distributed tls read endpoint= api v1 osquery distributed read distributed tls write endpoint= api v1 osquery distributed write logger plugin=tls logger tls endpoint= api v1 osquery log logger tls period=10

SK · Answer

In the pem you will need to add also the root ca

xiaoliuzi · Answer

Should I copy the root ca to pem

SK · Answer

yes and all intermediate for the kolide server the osquery agent needs the whole chain to be able to authenticate

xiaoliuzi · Answer

The kolide server and osquery are on the same LAN Are there any intermediate products

SK · Answer

With intermediate I mean possible intermediate CAs in your cert chain so root CA and all intermediate CAs and than kolide cert

xiaoliuzi · Answer

E0416 23 11 <tel 194864386129|19 486438 6129> init cpp 509 Cannot activate tls logger plugin No node key TLS logging disabled Why is this

SK · Answer

host identifier should be the value uuid or hostname not an IP address or remove the whole line it will default to hostname maybe this helps your issue

SK · Answer

And probably tls hostname should be the systemname used to create the cert

xiaoliuzi · Answer

thanks I have fixed this problem

Shantanu · Answer

I am facing a similar problem Where can I find the root ca

SK · Answer

Hey < Shantanu> root CA should be available when you navigate to Kolide webpage

Shantanu · Answer

Do you mean the kolide server webpage or the kolide website

SK · Answer

Your kolide server webpage you should be able to download the cert chain from there

Shantanu · Answer

Is it the same in case of self signed certs I am able to add ubuntu hosts to fleet using the pem file I get from the kolide server when I click on add new hosts This error pops up only while adding windows host using the same pem file

SK · Answer

< Shantanu> not sure about that If it works for Ubuntu it should work for Windows I guess Check in the < C0FHNQ2N6|windows> channel if anyone else has experienced this

Shantanu · Answer

< SK> I found a few posts with same problem but no solution to those I have posted my issue on < C1XCLA5DZ|kolide> as well