Certificate error occurred when installing the fleet server

[lovelike123]

I can use curl --cacert /www/server/elastic/es1/config/certs/elasticsearch-ca.crt -u elastic https://192.168.2.188:9200 this command to connect

Use the curl -v --cacert /www/server/elastic-agent/certs/elasticsearch-ca.crt https://192.168.2.188:9200 this command without identity credentials

[lovelike123]

There is no certificate error now, but I have been waiting for the installation of the fleet server

[hendry.lim (Hendry)]

Is there any log file? If yes, can you share the content of the Elastic Agent log?

[lovelike123]

If there is no log information, you have to wait all the time. After waiting, an error occurs. You cannot install the fleet server, like this

I put elasticsearch-ca.crt in the directory/usr/local/share/ca-certificates, so there is no certificate error, but the fleet server has never been installed

[lovelike123]

If I delete the certificate in the/usr/local/share/ca-certificates directory, a certificate error will occur

[hendry.lim (Hendry)]

I think we have established that the certificate is correct. The Fleet Server seems to not able to retrieve the Fleet server policy from Elasticsearch. Can you also share the agent policy?

[lovelike123]

id: 1d940ef0-8107-11ed-b9f0-c1afc5e7029d
revision: 3
outputs:
default:
type: elasticsearch
hosts:
- 'https://192.168.2.188:9200'
ssl.ca_trusted_fingerprint: 41bb4495d245ad44c715f1ce58d144ab07e4036940f3eaded1f8ffc3ba2c7907
output_permissions:
default:
_elastic_agent_monitoring:
indices:
- names:
- logs-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
_elastic_agent_checks:
cluster:
- monitor
529ce2d7-d074-4348-b64d-ed7cc84ed84f:
indices:
- names:
- logs-system.syslog-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.auth-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.application-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.system-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.fsstat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.cpu-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.uptime-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.filesystem-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.load-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.diskio-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process.summary-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.memory-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.network-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.socket_summary-default
privileges:
- auto_configure
- create_doc
agent:
download:
source_uri: 'https://artifacts.elastic.co/downloads/'
monitoring:
enabled: true
use_output: default
namespace: default
logs: true
metrics: true
inputs:

• id: logfile-system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  name: system-2
  revision: 1
  type: logfile
  use_output: default
  meta:
  package:
  name: system
  version: 1.20.4
  data_stream:
  namespace: default
  package_policy_id: 529ce2d7-d074-4348-b64d-ed7cc84ed84f
  streams:
  • id: logfile-system.syslog-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.syslog
    type: logs
    paths:
    • /var/log/messages*
    • /var/log/syslog*
      exclude_files:
    • .gz$
      multiline:
      pattern: ^\s
      match: after
      processors:
    • add_locale: null
      ignore_older: 72h
  • id: logfile-system.auth-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.auth
    type: logs
    ignore_older: 72h
    paths:
    • /var/log/auth.log*
    • /var/log/secure*
      exclude_files:
    • .gz$
      multiline:
      pattern: ^\s
      match: after
      tags:
    • system-auth
      processors:
    • add_locale: null
• id: winlog-system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  name: system-2
  revision: 1
  type: winlog
  use_output: default
  meta:
  package:
  name: system
  version: 1.20.4
  data_stream:
  namespace: default
  package_policy_id: 529ce2d7-d074-4348-b64d-ed7cc84ed84f
  streams:
  • id: winlog-system.application-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    name: Application
    data_stream:
    dataset: system.application
    type: logs
    condition: '${host.platform} == ''windows'''
    ignore_older: 72h
  • id: winlog-system.security-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    name: Security
    data_stream:
    dataset: system.security
    type: logs
    condition: '${host.platform} == ''windows'''
    ignore_older: 72h
  • id: winlog-system.system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    name: System
    data_stream:
    dataset: system.system
    type: logs
    condition: '${host.platform} == ''windows'''
    ignore_older: 72h
• id: system/metrics-system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  name: system-2
  revision: 1
  type: system/metrics
  use_output: default
  meta:
  package:
  name: system
  version: 1.20.4
  data_stream:
  namespace: default
  package_policy_id: 529ce2d7-d074-4348-b64d-ed7cc84ed84f
  streams:
  • id: system/metrics-system.fsstat-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.fsstat
    type: metrics
    metricsets:
    • fsstat
      period: 1m
      processors:
    • drop_event.when.regexp:
      system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
  • id: system/metrics-system.cpu-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.cpu
    type: metrics
    metricsets:
    • cpu
      cpu.metrics:
    • percentages
    • normalized_percentages
      period: 10s
  • id: system/metrics-system.uptime-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.uptime
    type: metrics
    metricsets:
    • uptime
      period: 10s
  • id: system/metrics-system.filesystem-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.filesystem
    type: metrics
    metricsets:
    • filesystem
      period: 1m
      processors:
    • drop_event.when.regexp:
      system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
  • id: system/metrics-system.process-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.process
    type: metrics
    metricsets:
    • process
      period: 10s
      process.include_top_n.by_cpu: 5
      process.include_top_n.by_memory: 5
      process.cmdline.cache.enabled: true
      process.cgroups.enabled: false
      process.include_cpu_ticks: false
      processes:
    • .*
  • id: system/metrics-system.load-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.load
    type: metrics
    metricsets:
    • load
      condition: '${host.platform} != ''windows'''
      period: 10s
  • id: system/metrics-system.diskio-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.diskio
    type: metrics
    metricsets:
    • diskio
      diskio.include_devices: null
      period: 10s
  • id: >-
    system/metrics-system.process.summary-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.process.summary
    type: metrics
    metricsets:
    • process_summary
      period: 10s
  • id: system/metrics-system.memory-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.memory
    type: metrics
    metricsets:
    • memory
      period: 10s
  • id: system/metrics-system.network-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.network
    type: metrics
    metricsets:
    • network
      period: 10s
      network.interfaces: null
  • id: >-
    system/metrics-system.socket_summary-529ce2d7-d074-4348-b64d-ed7cc84ed84f
    data_stream:
    dataset: system.socket_summary
    type: metrics
    metricsets:
    • socket_summary
      period: 10s
      fleet:
      hosts:
  • 'https://192.168.2.188:8220'

[hendry.lim (Hendry)]

This policy doesn't have fleet-server integration. You need to add the Fleet Server integration to this policy in order to use this policy for the Fleet Server.

[lovelike123]

id: fleet-server-policy
revision: 5
outputs:
default:
type: elasticsearch
hosts:
- 'https://192.168.2.188:9200'
ssl.ca_trusted_fingerprint: 41bb4495d245ad44c715f1ce58d144ab07e4036940f3eaded1f8ffc3ba2c7907
output_permissions:
default:
_elastic_agent_monitoring:
indices:
- names:
- logs-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
_elastic_agent_checks:
cluster:
- monitor
92f21c6e-3af8-479d-930d-a815538d375b:
indices:
- names:
- logs-system.auth-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.syslog-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.application-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.system-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.cpu-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.diskio-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.filesystem-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.fsstat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.load-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.memory-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.network-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process.summary-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.socket_summary-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.uptime-default
privileges:
- auto_configure
- create_doc
agent:
download:
source_uri: 'https://artifacts.elastic.co/downloads/'
monitoring:
enabled: true
use_output: default
namespace: default
logs: true
metrics: true
inputs:

• id: logfile-system-92f21c6e-3af8-479d-930d-a815538d375b
  name: system-1
  revision: 1
  type: logfile
  use_output: default
  meta:
  package:
  name: system
  version: 1.20.4
  data_stream:
  namespace: default
  package_policy_id: 92f21c6e-3af8-479d-930d-a815538d375b
  streams:
  • id: logfile-system.auth-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.auth
    type: logs
    ignore_older: 72h
    paths:
    • /var/log/auth.log*
    • /var/log/secure*
      exclude_files:
    • .gz$
      multiline:
      pattern: ^\s
      match: after
      tags:
    • system-auth
      processors:
    • add_locale: null
  • id: logfile-system.syslog-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.syslog
    type: logs
    paths:
    • /var/log/messages*
    • /var/log/syslog*
      exclude_files:
    • .gz$
      multiline:
      pattern: ^\s
      match: after
      processors:
    • add_locale: null
      ignore_older: 72h
• id: winlog-system-92f21c6e-3af8-479d-930d-a815538d375b
  name: system-1
  revision: 1
  type: winlog
  use_output: default
  meta:
  package:
  name: system
  version: 1.20.4
  data_stream:
  namespace: default
  package_policy_id: 92f21c6e-3af8-479d-930d-a815538d375b
  streams:
  • id: winlog-system.application-92f21c6e-3af8-479d-930d-a815538d375b
    name: Application
    data_stream:
    dataset: system.application
    type: logs
    condition: '${host.platform} == ''windows'''
    ignore_older: 72h
  • id: winlog-system.security-92f21c6e-3af8-479d-930d-a815538d375b
    name: Security
    data_stream:
    dataset: system.security
    type: logs
    condition: '${host.platform} == ''windows'''
    ignore_older: 72h
  • id: winlog-system.system-92f21c6e-3af8-479d-930d-a815538d375b
    name: System
    data_stream:
    dataset: system.system
    type: logs
    condition: '${host.platform} == ''windows'''
    ignore_older: 72h
• id: system/metrics-system-92f21c6e-3af8-479d-930d-a815538d375b
  name: system-1
  revision: 1
  type: system/metrics
  use_output: default
  meta:
  package:
  name: system
  version: 1.20.4
  data_stream:
  namespace: default
  package_policy_id: 92f21c6e-3af8-479d-930d-a815538d375b
  streams:
  • id: system/metrics-system.cpu-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.cpu
    type: metrics
    metricsets:
    • cpu
      cpu.metrics:
    • percentages
    • normalized_percentages
      period: 10s
  • id: system/metrics-system.diskio-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.diskio
    type: metrics
    metricsets:
    • diskio
      diskio.include_devices: null
      period: 10s
  • id: system/metrics-system.filesystem-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.filesystem
    type: metrics
    metricsets:
    • filesystem
      period: 1m
      processors:
    • drop_event.when.regexp:
      system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
  • id: system/metrics-system.fsstat-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.fsstat
    type: metrics
    metricsets:
    • fsstat
      period: 1m
      processors:
    • drop_event.when.regexp:
      system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
  • id: system/metrics-system.load-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.load
    type: metrics
    metricsets:
    • load
      condition: '${host.platform} != ''windows'''
      period: 10s
  • id: system/metrics-system.memory-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.memory
    type: metrics
    metricsets:
    • memory
      period: 10s
  • id: system/metrics-system.network-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.network
    type: metrics
    metricsets:
    • network
      period: 10s
      network.interfaces: null
  • id: system/metrics-system.process-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.process
    type: metrics
    metricsets:
    • process
      period: 10s
      process.include_top_n.by_cpu: 5
      process.include_top_n.by_memory: 5
      process.cmdline.cache.enabled: true
      process.cgroups.enabled: false
      process.include_cpu_ticks: false
      processes:
    • .*
  • id: >-
    system/metrics-system.process.summary-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.process.summary
    type: metrics
    metricsets:
    • process_summary
      period: 10s
  • id: >-
    system/metrics-system.socket_summary-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.socket_summary
    type: metrics
    metricsets:
    • socket_summary
      period: 10s
  • id: system/metrics-system.uptime-92f21c6e-3af8-479d-930d-a815538d375b
    data_stream:
    dataset: system.uptime
    type: metrics
    metricsets:
    • uptime
      period: 10s
• id: fleet-server-fleet_server-229c764a-a441-4341-80d0-bfcb1099173b
  name: fleet_server-1
  revision: 3
  type: fleet-server
  use_output: default
  meta:
  package:
  name: fleet_server
  version: 1.2.0
  data_stream:
  namespace: default
  package_policy_id: 229c764a-a441-4341-80d0-bfcb1099173b
  server:
  port: 8220
  host: 0.0.0.0
  fleet:
  hosts:
  • 'https://192.168.2.188:8220'

[lovelike123]

Is there a fleet server integration,This is what I just sent

[lovelike123]

But I still can't use this installation

[hendry.lim (Hendry)]

Yes, your second policy contains Fleet Server integration, which looks correct.

[lovelike123]

I can use this, but there is no data

 sudo ./elastic-agent/elastic-agent install -f --url=https://192.168.2.188:8220 --fleet-server-es=https://192.168.2.188:9200 --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NzE2OTgzNTI2NjM6cDZseURVWlFRSHVOZTY5bDloTERwQQ --fleet-server-es-ca=/www/server/elastic-agent/certs/elasticsearch-ca.crt --certificate-authorities=/www/server/elastic-agent/certs/ca.crt --fleet-server-cert=/www/server/elastic-agent/certs/fleet-server.crt --fleet-server-cert-key=/www/server/elastic-agent/certs/fleet-server.key

[lovelike123]

When I query the data, the elasticsearch encounters an error

[hendry.lim (Hendry)]

Can you try to remove ssl.ca_trusted_fingerprint and add ssl.verification_mode: none in your Elasticsearch output configuration? See if that works.

I noticed you were using a different service token to enroll the Fleet Server this time, which worked, so as suspected, the service token was incorrect.

[lovelike123]

This parameter does not work. My elasticsearch version is 8.5.0

[hendry.lim (Hendry)]

I meant to add that ssl.verification_mode: none into the Elasticsearch output configuration in Fleet, not in elasticsearch.yml file.

[lovelike123]

In which file，is it in here

[hendry.lim (Hendry)]

Go to Kibana, Fleet > Settings > Elasticsearch output settings. There is a box where you can enter YAML configs.

[lovelike123]

The first one cannot be changed. I added one, but there was an error