Elastic Agent Enrollment Issue

[cyrisk-bot]

Version

2.4.170

Installation Method

Cloud image (Amazon, Azure, Google)

Description

configuration

Installation Type

Standalone

Location

cloud

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32GB

Storage for /

256GB

Storage for /nsm

256GB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I am having difficulty getting my workstation agent to enroll. The difficulty is in the fact that the Security Onion certificate has the internal/private AWS VPC address, whereas our external communication is through a public, Elastic IP. This is what the Powershell clean install log shows:
Installing in non-interactive mode. [= ] Service Started [4s] Elastic Agent successfully installed, starting enrollment. [ ===] Waiting For Enroll... [5s] {"log.level":"info","@timestamp":"2025-09-05T17:20:22.405-0400","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(*enrollCmd).enrollWithBackoff","file.name":"cmd/enroll_cmd.go","file.line":532},"message":"Starting enrollment to URL: https://18.116.219.53:8220/","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-09-05T17:20:22.835-0400","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(*enrollCmd).enrollWithBackoff","file.name":"cmd/enroll_cmd.go","file.line":538},"message":"1st enrollment attempt failed, retrying enrolling to URL: https://18.116.219.53:8220/ with exponential backoff (init 5s, max 10m0s)","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2025-09-05T17:20:22.835-0400","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(*enrollCmd).enrollWithBackoff","file.name":"cmd/enroll_cmd.go","file.line":557},"message":"Enrollment failed: fail to execute request to fleet-server: x509: certificate is valid for 172.31.31.156, not 18.116.219.53","ecs.version":"1.6.0"}
Any help is greatly appreciated

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

Try adding a custom fqdn - https://docs.securityonion.net/en/2.4/elastic-fleet.html#custom-fqdn-url

[cyrisk-bot]

OK. I am a bit of a neophyte. I only have a public IP. What format do I need to use for the FQDN? This is just a trial.

[cyrisk-bot]

And do I need to regenerate tokens?