You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: deploy-manage/monitor/autoops/autoops-sm-troubleshoot-custom-certification.md
+101-4Lines changed: 101 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,18 +4,115 @@ applies_to:
4
4
self:
5
5
ece:
6
6
eck:
7
-
navigation_title: Troubleshooting
7
+
navigation_title: {{agent}} not recognizing SSL certificate
8
8
products:
9
9
- id: cloud-kubernetes
10
10
- id: cloud-enterprise
11
11
---
12
12
13
-
# AutoOps for self-managed clusters troubleshooting
13
+
# Troubleshoot {{agent}} not recognizing custom SSL certificate
14
14
15
-
If {{agent}} is failing to connect to your self-managed cluster because it doesn't recognize your SSL certificate, this may be because your certificate is signed by a custom or internal Certificate Authority (CA). You may encounter an error similar to the following:
15
+
If {{agent}} is failing to connect your self-managed cluster to AutoOps because it doesn't recognize your SSL certificate, this may be because your certificate is signed by a custom or internal Certificate Authority (CA).
16
+
17
+
You may encounter an error like the following:
16
18
17
19
```sh
18
20
... x509: certificate signed by unknown authority ...
19
21
```
20
22
21
-
{{agent}} fails to connect to your self-managed cluster because the agent's host machine, the machine where you have installed the agent, does not natively trust your custom or internal CA. To fix this problem,
23
+
This error occurs because the machine where you have installed {{agent}} does not trust your custom or internal CA. To fix this error, you need to configure the agent with your custom certificate by providing its certificate file so that the machine trusts your CA.
24
+
25
+
This following section provides the steps to configure {{agent}} with a custom SSL certificate so that the agent can successfully connect your self-managed cluster to AutoOps.
26
+
27
+
## Configure AutoOps {{agent}} with a custom SSL certificate
28
+
29
+
To configure {{agent}} with your custom SSL certificate, you must edit the `elastic-agent.yml` file on the agent's host machine to add the path to your certificate. The host machine is the machine where you have installed the agent.
30
+
31
+
Complete the following steps:
32
+
33
+
1. On the host machine, open the `elastic-agent.yml` file. \
34
+
The default location is `/opt/Elastic/Agent/elastic-agent.yml`.
35
+
2. In the `elastic-agent.yml` file, locate the `receivers.metricbeatreceiver.metricbeat.modules` section.
36
+
3. In this section, there will be two modules configured for `autoops_es`, one for metrics and one for templates. \
37
+
Add the `ss.certificate_authorities` setting to both these modules using one of the following options:
38
+
39
+
:::::{tab-set}
40
+
:group: add-cert-auth-setting-to-module
41
+
42
+
::::{tab-item} Use environment variable (recommended)
43
+
:sync: env-variable
44
+
45
+
We recommend using this method because it's flexible and keeps sensitive paths out of your main configuration.
46
+
47
+
Add the following line to both `autoops_es` modules:
48
+
49
+
```yaml
50
+
ssl.certificate_authorities:
51
+
- ${env:AUTOOPS_CA_CERT}
52
+
```
53
+
After adding this line to both modules, make sure the` AUTOOPS_CA_CERT` environment variable is set on the host machine and contains the full path to your certificate file (for example: `/etc/ssl/certs/my_internal_ca.crt`).
54
+
::::
55
+
56
+
::::{tab-item} Hardcode file path
57
+
:sync: hardcode-file-path
58
+
59
+
Use this method to specify the path directly. This method is often simpler for fixed or test environments.
60
+
61
+
```yaml
62
+
ssl.certificate_authorities:
63
+
- "/path/to/your/ca.crt"
64
+
```
65
+
66
+
::::
67
+
68
+
:::::
69
+
70
+
$$$step-3-example$$$The following codeblock shows what your final configuration should look like. This example uses the second option, hardcoding the file path.
71
+
72
+
```yaml
73
+
receivers:
74
+
metricbeatreceiver:
75
+
metricbeat:
76
+
modules:
77
+
# Metrics
78
+
- module: autoops_es
79
+
hosts: ${env:AUTOOPS_ES_URL}
80
+
period: 10s
81
+
metricsets:
82
+
- cat_shards
83
+
- cluster_health
84
+
- cluster_settings
85
+
- license
86
+
- node_stats
87
+
- tasks_management
88
+
# --- ADD THIS LINE ---
89
+
ssl.certificate_authorities:
90
+
- "/path/to/your/ca.crt"
91
+
92
+
# Templates
93
+
- module: autoops_es
94
+
hosts: ${env:AUTOOPS_ES_URL}
95
+
period: 24h
96
+
metricsets:
97
+
- cat_template
98
+
- component_template
99
+
- index_template
100
+
# --- ADD THIS LINE ---
101
+
ssl.certificate_authorities:
102
+
- "/path/to/your/ca.crt"
103
+
```
104
+
4. Save your changes to the `elastic-agent.yml` file.
105
+
5. Restart {{agent}} so that the new settings can take effect.\
106
+
In most systemd-based Linux environments, you can use the following command to restart the agent:
107
+
```bash
108
+
sudo systemctl restart elastic-agent
109
+
```
110
+
6. Check the agent logs again to confirm that the error is gone and that {{agent}} has successfully connected your self-managed cluster to AutoOps.
111
+
112
+
:::{note}
113
+
If you encounter the following error in the agent logs, there may be a formatting issue in the `elastic-agent.yml` file.
114
+
```sh
115
+
... can not convert 'object' into 'string' ... ssl.certificate_authorities ...
116
+
```
117
+
To fix this error, ensure your configuration matches the [example codeblock](#step-3-example) provided in step 3. The `ss.certificate_authorities` setting must be a list item (indicated by the `-`) containing one or more strings (the respective path to your certification files).
Copy file name to clipboardExpand all lines: deploy-manage/monitor/autoops/cc-cloud-connect-autoops-troubleshooting.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -168,7 +168,7 @@ $$$firewall$$$**My organization's firewall may be preventing {{agent}} from coll
168
168
:::
169
169
170
170
$$$custom-cert$$$**{{agent}} is failing to connect because it doesn't recognize my SSL certificate.**
171
-
: If {{agent}} is failing to connect to your self-managed cluster because it doesn't recognize your SSL certificate, refer to [](/deploy-manage/monitor/autoops/autoops-sm-troubleshoot-custom-certification.md).
171
+
: If {{agent}} is failing to connect your self-managed cluster to AutoOps because it doesn't recognize your SSL certificate, refer to [](/deploy-manage/monitor/autoops/autoops-sm-troubleshoot-custom-certification.md).
0 commit comments