[CM] Unable to connect to TLS'd cluster for enrollment #9129
Labels
Comments
|
+1 |
|
I will mark it as a bug instead of an enhancement, if you want to use a custom CA the only solution at the moment would be to add the CA to the OS trust store and the enroll subcommand will pick it up. |
ph
changed the title
|
I think we should do the following, it appears that we already support having |
|
After talking with @mattapperson, since we are planning to move the enroll token to a web token we could add the CA as data in the web token and use that information when enrolling the beats. We would still need to allow the enroll subcommand to read the configuration from the yml when using the api with the username / password. |
ph
added a commit
to ph/beats
that referenced
this issue
Jan 9, 2019
The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: elastic#9129
ph
added a commit
that referenced
this issue
Jan 11, 2019
The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: #9129
ph
added a commit
to ph/beats
that referenced
this issue
Jan 11, 2019
The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: elastic#9129 (cherry picked from commit 0a914fa)
ph
added a commit
to ph/beats
that referenced
this issue
Jan 11, 2019
The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: elastic#9129 (cherry picked from commit 0a914fa)
ph
added a commit
to ph/beats
that referenced
this issue
Jan 11, 2019
The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: elastic#9129 (cherry picked from commit 0a914fa)
ph
added a commit
that referenced
this issue
Jan 13, 2019
…olling a beats (#10015) Cherry-pick of PR #9752 to 6.x branch. Original message: The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: #9129
ph
added a commit
that referenced
this issue
Jan 13, 2019
…olling a beats (#10017) Cherry-pick of PR #9752 to 6.5 branch. Original message: The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: #9129
ph
added a commit
that referenced
this issue
Jan 13, 2019
…olling a beats (#10016) Cherry-pick of PR #9752 to 6.6 branch. Original message: The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: #9129
leweafan
pushed a commit
to leweafan/beats
that referenced
this issue
Apr 28, 2023
…hen enrolling a beats (elastic#10016) Cherry-pick of PR elastic#9752 to 6.6 branch. Original message: The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: elastic#9129
leweafan
pushed a commit
to leweafan/beats
that referenced
this issue
Apr 28, 2023
…hen enrolling a beats (elastic#10017) Cherry-pick of PR elastic#9752 to 6.5 branch. Original message: The `enroll` subcommand allow to specify the CA and other SSL options when enrolling. Any TLS options will be persisted to the file and will be used when fetching the configuration. ``` ./filebeat enroll https://localhost:5601 d2eec88904f546f2816ce58061781c3d -E "management.kibana.ssl.certificate_authorities=/tmp/myca.crt" ``` Fixes: elastic#9129
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the enhancement:
When using an internal CA, or when you might have a hostname mismatch (for example: nat'd address) when enrolling in beat central management, there isn't a command line flag that gives the opportunity to specify ssl_verification: none, or specify a custom CA.
Describe a specific use case for the enhancement or feature:
In my deployments I sign from an internal CA, and need to specify the ssl settings in the configuration.
The text was updated successfully, but these errors were encountered: