Fleet-server: http: server gave HTTP response to HTTPS client

[ckim (Chan Kim)]

@secopsgeek

+ ./elastic-agent install -f --url=https://172.16.100.6:8220 --enrollme ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (2022-03-31T12:2....16.100.6:8220/:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
 
Error: fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/7.17/fleet-troubleshooting.html
Error: enroll command failed with exit code: 1

From the error message posted yesterday, it seems like enrollment didn't go well, and that needs to be addressed first.

If the Agent is running on your machine and is connected to Fleet with a policy that has Endpoint Security integration, let's check if the Agent has bootstrapped elastic-endpoint.exe, and is ready to accept connection.

• Please make sure Endpoint is extracted under the path Dan posted in step 3.
• Check if elastic-agent.exe is listening on port 6788.

[secopsgeek (Ronnie Watson)]

Yes they are from the windows Endpoint.
I am using elastic-agent-7.17.1-windows-x86_64.zip I can install the new version and try again.
I am not seeing the http.cpp error message in the logs.
I did remove the agent from elastic, do I need to reinstall the agent again to generate the error if so I can do that.

[secopsgeek (Ronnie Watson)]

Only port 17480:

[secopsgeek (Ronnie Watson)]

Any other advice for this issue?

[ckim (Chan Kim)]

@secopsgeek , that doesn't seem like a port number that Agent would be listening on. Can you double check using a terminal command like netstat ? You will need to filter out the output by the PID agent.

[secopsgeek (Ronnie Watson)]

Sorry, I am late responding butt I have this fixed now. I am running Elastic 8.1.2. The 7.17 version gave me problems ever since I upgraded from 7.16, so now I have all my Endpoints working.

I troubleshooted this problem Saturday morning and now I have everything working.