SSL issues on Fleet node: ca_server reported errors for ssl.etc_elasticfleet_crt and ssl.etc_elasticfleet_logstash_crt

[DoughnutPeach]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

16

Storage for /

300GB

Storage for /nsm

100GB

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Prior to the holidays, I had set up Fleet Node and it was working OK. Since then, we had to rename the host (minor changes from security-fleet-test to securityfleet-1).

Since then, so-elastic-fleet and so-logstash has stopped working. Sample so-status:

          Security Onion Status          
        Container │ Status  │    Details 
──────────────────┼─────────┼────────────
 so-elastic-fleet │ missing │            
      so-logstash │ missing │            
     so-sensoroni │ running │ Up 2 hours 
      so-telegraf │ running │ Up 2 hours 

 ❗ Check container logs and /opt/so/log for more details.

Attempting to run so-elastic-fleet-start --force and so-logstash-start --force gave the following errors:

----------
          ID: etc_elasticfleet_crt
    Function: x509.certificate_managed
        Name: /etc/pki/elasticfleet-server.crt
      Result: False
     Comment: Attempt 1: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              Attempt 2: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              Attempt 3: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              Attempt 4: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed
     Started: 08:48:39.285122
    Duration: 126029.113 ms
     Changes:  
.
.
.
----------
          ID: etc_elasticfleet_logstash_crt
    Function: x509.certificate_managed
        Name: /etc/pki/elasticfleet-logstash.crt
      Result: False
     Comment: Attempt 1: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              Attempt 2: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              Attempt 3: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              Attempt 4: Returned a result of "False", with the following comment: "ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed"
              ca_server reported errors:
              Codepoint U+003A at position 6 of 'https://172' not allowed
     Started: 08:50:46.007042
    Duration: 124810.46200000001 ms
     Changes:   
.
.
.
----------
          ID: so-elastic-fleet
    Function: docker_container.running
      Result: False
     Comment: One or more requisite failed: ssl.etc_elasticfleet_crt
     Started: 08:52:53.587642
    Duration: 0.003 ms
     Changes:  

I have also tried a fresh install, this time keeping the latest hostname securityfleet-1 from above. Still no luck, it seems like the CA is complaining.

I have tried removing /etc/pki/elasticfleet-logstash* and /etc/pki/elasticfleet-server* and from my knowledge, so-restart should regenerate the necessary keys and certs. Also deleted the relevant issued certs from my manager (manager: /etc/pki/issued_certs/). Also no luck.

Any help would be greatly appreciated. Thanks!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

This was reproduced by setting url_base or custom_fqdn to a value of 'https://172.x.x.x'

What's the output of
sudo salt-call pillar.get global:url_base
and
sudo salt-call pillar.get elasticfleet:config:server:custom_fqdn

[DoughnutPeach]

This are my outputs

sudo salt-call pillar.get global:url_base
local:
    172.18.xx.xx
sudo salt-call pillar.get elasticfleet:config:server:custom_fqdn
local:
    - https://172.18.xx.xx:8220

do i have to make changes to the sls file on my master?

[reyesj2]

Change them in SOC -> administration -> configuration. At the top of the page hit the options drop down and toggle 'Show all configurable settings' and set your filter to global.url_base
to change elasticfleet custom fqdn same configuration screen set your filter to elasticfleet.config.server.custom_fqdn

[DoughnutPeach]

Thanks for the quick response! Just to clarify, do I change the value of global.url_base to elasticfleet.config.server.custom_fqdn ? or should the value be the hostname of my master? i'm not able to see the elasticfleet.config.server.custom_fqdn in my configuration menu.

also, im more comfortable using the bash for this. these configs can also be found in the pillar configs on my master node, yes?

thanks so much for your help!

[DoughnutPeach]

I found the settings on my master node's /opt/so/saltstack/local/pillar/elasticfleet/soc_elasticfleet.sls and /opt/so/saltstack/local/pillar/global/soc_elasticfleet.sls.

am i right to make the following changes?
global.url_base should be -> hostname of master node
elasticfleet.config.server.custom_fqdn should be -> hostname of my fleet node

[reyesj2]

https://docs.securityonion.net/en/2.4/url-base.html#web-access-url
https://docs.securityonion.net/en/2.4/elastic-fleet.html#custom-fqdn-url

You don't see the custom_fqdn config because you don't have the 'show all configurable settings' toggled on

[DoughnutPeach]

Thanks for your help @reyesj2 ! Changing custom_fqdn from https://172.18.xx.xx:8220 -> <hostname> worked!