Certificate error occurred when installing the fleet server

lovelike123 · December 22, 2022, 2:53am

I can use curl --cacert /www/server/elastic/es1/config/certs/elasticsearch-ca.crt -u elastic https://192.168.2.188:9200 this command to connect

Use the curl -v --cacert /www/server/elastic-agent/certs/elasticsearch-ca.crt https://192.168.2.188:9200 this command without identity credentials

lovelike123 · December 22, 2022, 3:18am

There is no certificate error now, but I have been waiting for the installation of the fleet server

hendry.lim · December 22, 2022, 3:56am

Is there any log file? If yes, can you share the content of the Elastic Agent log?

lovelike123 · December 22, 2022, 6:02am

If there is no log information, you have to wait all the time. After waiting, an error occurs. You cannot install the fleet server, like this

I put elasticsearch-ca.crt in the directory/usr/local/share/ca-certificates, so there is no certificate error, but the fleet server has never been installed

lovelike123 · December 22, 2022, 6:14am

If I delete the certificate in the/usr/local/share/ca-certificates directory, a certificate error will occur

hendry.lim · December 22, 2022, 7:00am

I think we have established that the certificate is correct. The Fleet Server seems to not able to retrieve the Fleet server policy from Elasticsearch. Can you also share the agent policy?

lovelike123 · December 22, 2022, 7:08am

id: 1d940ef0-8107-11ed-b9f0-c1afc5e7029d
revision: 3
outputs:
default:
type: elasticsearch
hosts:
- 'https://192.168.2.188:9200'
ssl.ca_trusted_fingerprint: 41bb4495d245ad44c715f1ce58d144ab07e4036940f3eaded1f8ffc3ba2c7907
output_permissions:
default:
_elastic_agent_monitoring:
indices:
- names:
- logs-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
_elastic_agent_checks:
cluster:
- monitor
529ce2d7-d074-4348-b64d-ed7cc84ed84f:
indices:
- names:
- logs-system.syslog-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.auth-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.application-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.system-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.fsstat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.cpu-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.uptime-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.filesystem-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.load-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.diskio-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process.summary-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.memory-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.network-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.socket_summary-default
privileges:
- auto_configure
- create_doc
agent:
download:
source_uri: 'https://artifacts.elastic.co/downloads/'
monitoring:
enabled: true
use_output: default
namespace: default
logs: true
metrics: true
inputs:

id: logfile-system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
name: system-2
revision: 1
type: logfile
use_output: default
meta:
package:
name: system
version: 1.20.4
data_stream:
namespace: default
package_policy_id: 529ce2d7-d074-4348-b64d-ed7cc84ed84f
streams:
- id: logfile-system.syslog-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.syslog
  type: logs
  paths:
  - /var/log/messages*
  - /var/log/syslog*
    exclude_files:
  - .gz$
    multiline:
    pattern: ^\s
    match: after
    processors:
  - add_locale: null
    ignore_older: 72h
- id: logfile-system.auth-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.auth
  type: logs
  ignore_older: 72h
  paths:
  - /var/log/auth.log*
  - /var/log/secure*
    exclude_files:
  - .gz$
    multiline:
    pattern: ^\s
    match: after
    tags:
  - system-auth
    processors:
  - add_locale: null
id: winlog-system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
name: system-2
revision: 1
type: winlog
use_output: default
meta:
package:
name: system
version: 1.20.4
data_stream:
namespace: default
package_policy_id: 529ce2d7-d074-4348-b64d-ed7cc84ed84f
streams:
- id: winlog-system.application-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  name: Application
  data_stream:
  dataset: system.application
  type: logs
  condition: '${host.platform} == ''windows'''
  ignore_older: 72h
- id: winlog-system.security-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  name: Security
  data_stream:
  dataset: system.security
  type: logs
  condition: '${host.platform} == ''windows'''
  ignore_older: 72h
- id: winlog-system.system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  name: System
  data_stream:
  dataset: system.system
  type: logs
  condition: '${host.platform} == ''windows'''
  ignore_older: 72h
id: system/metrics-system-529ce2d7-d074-4348-b64d-ed7cc84ed84f
name: system-2
revision: 1
type: system/metrics
use_output: default
meta:
package:
name: system
version: 1.20.4
data_stream:
namespace: default
package_policy_id: 529ce2d7-d074-4348-b64d-ed7cc84ed84f
streams:
- id: system/metrics-system.fsstat-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.fsstat
  type: metrics
  metricsets:
  - fsstat
    period: 1m
    processors:
  - drop_event.when.regexp:
    system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
- id: system/metrics-system.cpu-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.cpu
  type: metrics
  metricsets:
  - cpu
    cpu.metrics:
  - percentages
  - normalized_percentages
    period: 10s
- id: system/metrics-system.uptime-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.uptime
  type: metrics
  metricsets:
  - uptime
    period: 10s
- id: system/metrics-system.filesystem-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.filesystem
  type: metrics
  metricsets:
  - filesystem
    period: 1m
    processors:
  - drop_event.when.regexp:
    system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
- id: system/metrics-system.process-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.process
  type: metrics
  metricsets:
  - process
    period: 10s
    process.include_top_n.by_cpu: 5
    process.include_top_n.by_memory: 5
    process.cmdline.cache.enabled: true
    process.cgroups.enabled: false
    process.include_cpu_ticks: false
    processes:
  - .*
- id: system/metrics-system.load-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.load
  type: metrics
  metricsets:
  - load
    condition: '${host.platform} != ''windows'''
    period: 10s
- id: system/metrics-system.diskio-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.diskio
  type: metrics
  metricsets:
  - diskio
    diskio.include_devices: null
    period: 10s
- id: >-
  system/metrics-system.process.summary-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.process.summary
  type: metrics
  metricsets:
  - process_summary
    period: 10s
- id: system/metrics-system.memory-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.memory
  type: metrics
  metricsets:
  - memory
    period: 10s
- id: system/metrics-system.network-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.network
  type: metrics
  metricsets:
  - network
    period: 10s
    network.interfaces: null
- id: >-
  system/metrics-system.socket_summary-529ce2d7-d074-4348-b64d-ed7cc84ed84f
  data_stream:
  dataset: system.socket_summary
  type: metrics
  metricsets:
  - socket_summary
    period: 10s
    fleet:
    hosts:
- 'https://192.168.2.188:8220'

hendry.lim · December 22, 2022, 7:17am

This policy doesn't have fleet-server integration. You need to add the Fleet Server integration to this policy in order to use this policy for the Fleet Server.

lovelike123 · December 22, 2022, 7:19am

id: fleet-server-policy
revision: 5
outputs:
default:
type: elasticsearch
hosts:
- 'https://192.168.2.188:9200'
ssl.ca_trusted_fingerprint: 41bb4495d245ad44c715f1ce58d144ab07e4036940f3eaded1f8ffc3ba2c7907
output_permissions:
default:
_elastic_agent_monitoring:
indices:
- names:
- logs-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.apm_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.auditbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.cloudbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.elastic_agent-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.endpoint_security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.filebeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.fleet_server-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.heartbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.metricbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.osquerybeat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
- names:
- logs-elastic_agent.packetbeat-default
privileges:
- auto_configure
- create_doc
_elastic_agent_checks:
cluster:
- monitor
92f21c6e-3af8-479d-930d-a815538d375b:
indices:
- names:
- logs-system.auth-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.syslog-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.application-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.security-default
privileges:
- auto_configure
- create_doc
- names:
- logs-system.system-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.cpu-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.diskio-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.filesystem-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.fsstat-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.load-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.memory-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.network-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.process.summary-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.socket_summary-default
privileges:
- auto_configure
- create_doc
- names:
- metrics-system.uptime-default
privileges:
- auto_configure
- create_doc
agent:
download:
source_uri: 'https://artifacts.elastic.co/downloads/'
monitoring:
enabled: true
use_output: default
namespace: default
logs: true
metrics: true
inputs:

id: logfile-system-92f21c6e-3af8-479d-930d-a815538d375b
name: system-1
revision: 1
type: logfile
use_output: default
meta:
package:
name: system
version: 1.20.4
data_stream:
namespace: default
package_policy_id: 92f21c6e-3af8-479d-930d-a815538d375b
streams:
- id: logfile-system.auth-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.auth
  type: logs
  ignore_older: 72h
  paths:
  - /var/log/auth.log*
  - /var/log/secure*
    exclude_files:
  - .gz$
    multiline:
    pattern: ^\s
    match: after
    tags:
  - system-auth
    processors:
  - add_locale: null
- id: logfile-system.syslog-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.syslog
  type: logs
  paths:
  - /var/log/messages*
  - /var/log/syslog*
    exclude_files:
  - .gz$
    multiline:
    pattern: ^\s
    match: after
    processors:
  - add_locale: null
    ignore_older: 72h
id: winlog-system-92f21c6e-3af8-479d-930d-a815538d375b
name: system-1
revision: 1
type: winlog
use_output: default
meta:
package:
name: system
version: 1.20.4
data_stream:
namespace: default
package_policy_id: 92f21c6e-3af8-479d-930d-a815538d375b
streams:
- id: winlog-system.application-92f21c6e-3af8-479d-930d-a815538d375b
  name: Application
  data_stream:
  dataset: system.application
  type: logs
  condition: '${host.platform} == ''windows'''
  ignore_older: 72h
- id: winlog-system.security-92f21c6e-3af8-479d-930d-a815538d375b
  name: Security
  data_stream:
  dataset: system.security
  type: logs
  condition: '${host.platform} == ''windows'''
  ignore_older: 72h
- id: winlog-system.system-92f21c6e-3af8-479d-930d-a815538d375b
  name: System
  data_stream:
  dataset: system.system
  type: logs
  condition: '${host.platform} == ''windows'''
  ignore_older: 72h
id: system/metrics-system-92f21c6e-3af8-479d-930d-a815538d375b
name: system-1
revision: 1
type: system/metrics
use_output: default
meta:
package:
name: system
version: 1.20.4
data_stream:
namespace: default
package_policy_id: 92f21c6e-3af8-479d-930d-a815538d375b
streams:
- id: system/metrics-system.cpu-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.cpu
  type: metrics
  metricsets:
  - cpu
    cpu.metrics:
  - percentages
  - normalized_percentages
    period: 10s
- id: system/metrics-system.diskio-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.diskio
  type: metrics
  metricsets:
  - diskio
    diskio.include_devices: null
    period: 10s
- id: system/metrics-system.filesystem-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.filesystem
  type: metrics
  metricsets:
  - filesystem
    period: 1m
    processors:
  - drop_event.when.regexp:
    system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
- id: system/metrics-system.fsstat-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.fsstat
  type: metrics
  metricsets:
  - fsstat
    period: 1m
    processors:
  - drop_event.when.regexp:
    system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
- id: system/metrics-system.load-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.load
  type: metrics
  metricsets:
  - load
    condition: '${host.platform} != ''windows'''
    period: 10s
- id: system/metrics-system.memory-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.memory
  type: metrics
  metricsets:
  - memory
    period: 10s
- id: system/metrics-system.network-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.network
  type: metrics
  metricsets:
  - network
    period: 10s
    network.interfaces: null
- id: system/metrics-system.process-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.process
  type: metrics
  metricsets:
  - process
    period: 10s
    process.include_top_n.by_cpu: 5
    process.include_top_n.by_memory: 5
    process.cmdline.cache.enabled: true
    process.cgroups.enabled: false
    process.include_cpu_ticks: false
    processes:
  - .*
- id: >-
  system/metrics-system.process.summary-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.process.summary
  type: metrics
  metricsets:
  - process_summary
    period: 10s
- id: >-
  system/metrics-system.socket_summary-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.socket_summary
  type: metrics
  metricsets:
  - socket_summary
    period: 10s
- id: system/metrics-system.uptime-92f21c6e-3af8-479d-930d-a815538d375b
  data_stream:
  dataset: system.uptime
  type: metrics
  metricsets:
  - uptime
    period: 10s
id: fleet-server-fleet_server-229c764a-a441-4341-80d0-bfcb1099173b
name: fleet_server-1
revision: 3
type: fleet-server
use_output: default
meta:
package:
name: fleet_server
version: 1.2.0
data_stream:
namespace: default
package_policy_id: 229c764a-a441-4341-80d0-bfcb1099173b
server:
port: 8220
host: 0.0.0.0
fleet:
hosts:
- 'https://192.168.2.188:8220'

lovelike123 · December 22, 2022, 7:33am

Is there a fleet server integration,This is what I just sent

lovelike123 · December 22, 2022, 7:35am

But I still can't use this installation

hendry.lim · December 22, 2022, 7:41am

Yes, your second policy contains Fleet Server integration, which looks correct.

lovelike123 · December 22, 2022, 8:42am

I can use this, but there is no data

 sudo ./elastic-agent/elastic-agent install -f --url=https://192.168.2.188:8220 --fleet-server-es=https://192.168.2.188:9200 --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NzE2OTgzNTI2NjM6cDZseURVWlFRSHVOZTY5bDloTERwQQ --fleet-server-es-ca=/www/server/elastic-agent/certs/elasticsearch-ca.crt --certificate-authorities=/www/server/elastic-agent/certs/ca.crt --fleet-server-cert=/www/server/elastic-agent/certs/fleet-server.crt --fleet-server-cert-key=/www/server/elastic-agent/certs/fleet-server.key

lovelike123 · December 22, 2022, 8:49am

When I query the data, the elasticsearch encounters an error

hendry.lim · December 22, 2022, 9:05am

Can you try to remove ssl.ca_trusted_fingerprint and add ssl.verification_mode: none in your Elasticsearch output configuration? See if that works.

I noticed you were using a different service token to enroll the Fleet Server this time, which worked, so as suspected, the service token was incorrect.

lovelike123 · December 23, 2022, 1:15am

This parameter does not work. My elasticsearch version is 8.5.0

hendry.lim · December 23, 2022, 1:43am

I meant to add that ssl.verification_mode: none into the Elasticsearch output configuration in Fleet, not in elasticsearch.yml file.

lovelike123 · December 23, 2022, 2:09am

In which file，is it in here

hendry.lim · December 23, 2022, 2:17am

Go to Kibana, Fleet > Settings > Elasticsearch output settings. There is a box where you can enter YAML configs.

lovelike123 · December 23, 2022, 2:32am

The first one cannot be changed. I added one, but there was an error

Topic		Replies	Views
Is there a way to ease installing fleet server to a elasticsearch server secured by self-signed certificate Elastic Observability fleet	8	4242	November 4, 2022
Fleet Server Intergrations not working on Self Hosted Cluster w/ Self Signed Certs Elastic Agent	2	148	June 5, 2024
Fleet Server Private Certificates Error Elasticsearch fleet	7	62	August 12, 2024
Fleet Server x509 Error (GODEBUG=x509ignoreCN=0) Beats fleet , elastic-agent	5	2120	September 27, 2021
Fleet Server - Error - x509: certificate is valid for 127.0.0.1, not x.x.x.x Elastic Security elastic-stack-security , fleet	3	4991	June 27, 2022

Certificate error occurred when installing the fleet server

Related topics