Endpoints are enrolling stuck message

Elastic Security Endpoint Security
7

Hello @VictorG and @AirJordan,

Can you confirm that you have the certificate authority generated by certutil installed on the host?
And that ElasticEndpoint has been restarted since doing so?

I was able to start up an endpoint with the same error message:
Http.cpp:38 CURL error 60: Error [SSL certificate problem: unable to get local issuer certificate]

Then I was able to connect to elasticsearch by doing those two things. First, installing the self-signed certificate authority on the machine running ElasticEndpoint, and second, stopping and starting the ElasticEndpoint service. (Re-reading the system certificate authorities requires a new policy be applied, or ElasticEndpoint restart)

I installed certificate authority by doing the following on my Windows 10 box. Hopefully, the steps are similar for you:

  1. Copy the generated self-signed elasticsearch certificate authority, ca.crt, to the endpoint host.
  2. Double click ca.crt
  3. Click Install Certificate
  4. Select Local Machine
  5. Click Next
  6. Select Place all certificates in the following store
  7. Click Browse
  8. Select Trusted Root Certification Authorities
  9. Click OK
  10. Click Next
  11. Click Finish
  12. See a pop up The import was successful
  13. Click OK to dismiss the pop up
  14. Click OK to dismiss the Certficate window

I stopped and start the ElasticEndpoint service be doing the following:

  1. Start task manager
  2. Select the Services tab
  3. Right Click ElasticEndpoint
  4. Select Stop
  5. Wait for PID to become blank
  6. Right Click ElasticEndpoint
  7. Select Start

I sure hope this helps.

1 Like