SO 2.3.260 Added SSL cert for web interface now fleet hosts all show offline

[jgiuliano2024]

Now that our SO instance is secure with a valid ssl cert fleet hosts are all showing as offline. If I revert back to orig cert that came with SO using IP as url hosts show online again. I followed all the posts I could find on the matter, one of which was after changing IP of SO and delete cert files and let salt recreate them. This did not work. Also it mentioned deleting managerssl.key but this takes away the ssl cert we are needing to use.
Any help would be great

Thanks
Joe

[cm-ops]

Did you try this troubleshooting already? https://docs.securityonion.net/en/latest/osquery.html#agents-troubleshooting

[cm-ops]

Replace the $MANAGER with your manager's IP.

[jgiuliano2024]

I actually tried that as well but it never produced a response. I am running it again from a few different clients and will just leave it to see if anything comes back. I will post results.

Thanks for helping on this

[jgiuliano2024]

Just got something back

140706269861184:error:0200206E:system library:connect:Connection timed out:../crypto/bio/b_sock2.c:110:
140706269861184:error:2008A067:BIO routines:BIO_connect:connect error:../crypto/bio/b_sock2.c:111:
connect:errno=110

[cm-ops]

What is your url_base? Are you using a custom Fleet hostname? Check cat /etc/so-launcher/launcher.flags on one of your endpoints to validate the config.

[jgiuliano2024]

url base is [email protected] <---example not real domain name
No custom fleet name

enroll_secret_path /etc/so-launcher/secret
hostname [email protected]:8090 <---example not real domain name
root_directory /var/so-launcher/securityonion
osqueryd_path /usr/local/so-launcher/bin/osqueryd
root_pem /etc/so-launcher/roots.pem
autoupdate
update_channel stable

Everything looks correct?