You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Click**Edit hosts** and specify the host URLs your {{agent}}s will use to connect to a {{fleet-server}}.
21
+
Select**Edit hosts** and specify the host URLs your {{agent}}s will use to connect to a {{fleet-server}}.
22
22
23
23
::::{tip}
24
24
If the **Edit hosts** option is grayed out, {{fleet-server}} hosts are configured outside of {{fleet}}. For more information, refer to [{{fleet}} settings in {{kib}}](kibana://reference/configuration-reference/fleet-settings.md).
@@ -49,7 +49,7 @@ The exposed ports must be open for ingress and egress in the firewall and networ
49
49
::::
50
50
51
51
52
-
Specify multiple URLs (click**Add row**) to scale out your deployment and provide automatic failover. If multiple URLs exist, {{fleet}} shows the first provided URL for enrollment purposes. Enrolled {{agent}}s will connect to the URLs in round robin order until they connect successfully.
52
+
Specify multiple URLs (select**Add row**) to scale out your deployment and provide automatic failover. If multiple URLs exist, {{fleet}} shows the first provided URL for enrollment purposes. Enrolled {{agent}}s will connect to the URLs in round robin order until they connect successfully.
53
53
54
54
When a {{fleet-server}} is added or removed from the list, all agent policies are updated automatically.
55
55
@@ -76,8 +76,8 @@ The {{ecloud}} internal output is locked and cannot be edited. This output is us
76
76
77
77
To add or edit an output:
78
78
79
-
1. Go to **{{fleet}} → Settings**.
80
-
2. Under **Outputs**, click**Add output** or **Edit**.
79
+
1. Go to **{{fleet}} > Settings**.
80
+
2. Under **Outputs**, select**Add output** or **Edit**.
If the options for editing an output are grayed out, outputs are configured outside of {{fleet}}. For more information, refer to [{{fleet}} settings in {{kib}}](kibana://reference/configuration-reference/fleet-settings.md).
@@ -109,12 +109,42 @@ For {{agent}}s that cannot access the internet, you can specify agent binary dow
109
109
110
110
To add or edit the source of binary downloads:
111
111
112
-
1. Go to **{{fleet}} → Settings**.
113
-
2. Under **Agent Binary Download**, click**Add agent binary source** or **Edit**.
112
+
1. Go to **{{fleet}} > Settings**.
113
+
2. Under **Agent Binary Download**, select**Add agent binary source** or **Edit**.
114
114
3. Set the agent binary source name.
115
115
4. For **Host**, specify the address where you are hosting the artifacts repository.
116
116
5. (Optional) To make this location the default, select **Make this host the default for all agent policies**. {{agent}}s use the default location if you don’t select a different agent binary source in the agent policy.
{{agent}}s must be able to access the {{artifact-registry}} to download binaries during upgrades. By default {{agent}}s download artifacts from the artifact registry at `https://artifacts.elastic.co/downloads/`.
121
+
122
+
For {{agent}}s that cannot access the internet, you can specify agent binary download settings, and then configure agents to download their artifacts from the alternate location. For more information about running {{agent}}s in a restricted environment, refer to [Air-gapped environments](/reference/fleet/air-gapped.md).
123
+
124
+
To add or edit the source of binary downloads:
125
+
126
+
1. Go to **{{fleet}} > Settings**.
127
+
2. Under **Agent Binary Download**, select **Add agent binary source** or **Edit**.
128
+
3. Set the agent binary source name.
129
+
4. For **Host**, specify the address where you are hosting the artifacts repository.
130
+
5. (Optional) To make this location the default, select **Make this host the default for all agent policies**. {{agent}}s use the default location if you don’t select a different agent binary source in the agent policy.
131
+
132
+
133
+
### Configure SSL for binary downloads [agent-binary-ssl]
134
+
```{applies_to}
135
+
stack: ga 9.1
136
+
```
137
+
138
+
You can optionally secure connections to your binary download source using TLS. These settings correspond to the certificates the agent uses when connecting to the download host.
139
+
140
+
The following SSL options are available when adding or editing an agent binary source:
Copy file name to clipboardExpand all lines: reference/fleet/secure-connections.md
+42-6Lines changed: 42 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,7 +42,6 @@ When you run {{agent}} with the {{elastic-defend}} integration, the [TLS certifi
42
42
::::
43
43
44
44
45
-
46
45
## Generate a custom certificate and private key for {{fleet-server}} [generate-fleet-server-certs]
47
46
48
47
This section describes how to use the `certutil` tool provided by {{es}}, but you can use whatever process you typically use to generate PEM-formatted certificates.
@@ -84,8 +83,11 @@ This section describes how to use the `certutil` tool provided by {{es}}, but yo
84
83
Store the files in a secure location. You’ll need these files later to encrypt traffic between {{agent}}s and {{fleet-server}}.
85
84
86
85
86
+
## Configure SSL/TLS using CLI [fleet-server-ssl-cli-settings]
87
+
88
+
Use the CLI to configure SSL or TLS when installing or enrolling {{fleet-server}}. This method gives you granular control over certificate paths, verification modes, and authentication behavior.
87
89
88
-
## Encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}} [_encrypt_traffic_between_agents_fleet_server_and_es]
90
+
### Encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}} [_encrypt_traffic_between_agents_fleet_server_and_es]
89
91
90
92
{{fleet-server}} needs a CA certificate or the CA fingerprint to connect securely to {{es}}. It also needs to expose a {{fleet-server}} certificate so other {{agent}}s can connect to it securely.
91
93
@@ -101,15 +103,15 @@ For the steps in this section, imagine you have the following files:
101
103
To encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}}:
102
104
103
105
1. Configure {{fleet}} settings. These settings are applied to all {{fleet}}-managed {{agent}}s.
104
-
2. In {{kib}}, open the main menu, thenclick**Management > {{fleet}} > Settings**.
106
+
2. In {{kib}}, open the main menu, thenselect**Management> {{fleet}} > Settings**.
105
107
106
108
1. Under **{{fleet-server}} hosts**, specify the URLs {{agent}}s will use to connect to {{fleet-server}}. For example, [https://192.0.2.1:8220](https://192.0.2.1:8220), where 192.0.2.1 is the host IP where you will install {{fleet-server}}.
107
109
108
110
::::{tip}
109
111
For host settings, use the `https` protocol. DNS-based names are also allowed.
110
112
::::
111
113
112
-
2. Under **Outputs**, search forthe default output, then click the **Edit** iconin the **Action** column.
114
+
2. Under **Outputs**, search forthe default output, then select the **Edit** iconin the **Action** column.
113
115
3. In the **Hosts** field, specify the {{es}} URLs where {{agent}}s will send data. For example, [https://192.0.2.0:9200](https://192.0.2.0:9200).
114
116
4. Specify either a CA certificate or CA fingerprint to connect securely {{es}}:
115
117
@@ -156,7 +158,7 @@ To encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}}:
156
158
157
159
1. Install an {{agent}} as a {{fleet-server}} on the host and configure it to use TLS:
158
160
159
-
1. If you don’t already have a {{fleet-server}} service token, click the **Agents** tab in {{fleet}} and follow the instructions to generate the service token now.
161
+
1. If you don’t already have a {{fleet-server}} service token, selectthe**Agents** tab in {{fleet}} and follow the instructions to generate the service token now.
160
162
161
163
::::{tip}
162
164
The in-product installation steps are incomplete. Before running the `install` command, add the settings shown in the next step.
@@ -268,6 +270,40 @@ To encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}}:
268
270
`certificate-authorities`
269
271
: CA certificate to use to connect to {{fleet-server}}. This is the CA used to [generate a certificate and key](#generate-fleet-server-certs) for {{fleet-server}}.
270
272
271
-
Don’t have an enrollment token? On the **Agents** tab in {{fleet}}, click **Add agent**. Under **Enroll and start the Elastic Agent**, follow the in-product installation steps, making sure that you add the `--certificate-authorities` option before you run the command.
273
+
Don’t have an enrollment token? On the **Agents** tab in {{fleet}}, select**Add agent**. Under **Enroll and start the Elastic Agent**, follow the in-product installation steps, making sure that you add the `--certificate-authorities` option before you run the command.
274
+
275
+
276
+
## Configure SSL/TLS using {{kib}} [fleet-server-ssl-ui-settings]
277
+
```{applies_to}
278
+
stack: ga 9.1
279
+
```
280
+
281
+
You can configure SSL/TLS settings for{{fleet-server}} hosts directlyin the {{fleet}} UI, without relying on CLI flags or policy overrides.
282
+
283
+
To access these settings:
284
+
285
+
1. In **Kibana**, go to **Management > {{fleet}} > Settings**.
286
+
2. Under **{{fleet-server}} hosts**, select**Add host** or edit an existing host.
287
+
3. Expand the **SSL options** section.
288
+
289
+
### SSL options
290
+
291
+
These are the available UI fields and their CLI equivalents:
292
+
293
+
The following table shows the available UI fields and their CLI equivalents:
Editing SSL or proxy settings for an existing {{fleet-server}} might cause agents to lose connectivity. After changing client certificate settings, you might need to re-enroll the affected agents.
307
+
:::
273
308
309
+
To configure a mutual TLS connection from {{fleet-server}} to {{es}}, use the {{es}} output settings. For more information, refer to [Output SSL options](/reference/fleet/tls-overview.md#output-ssl-options).
Copy file name to clipboardExpand all lines: reference/fleet/tls-overview.md
+49Lines changed: 49 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,8 +10,11 @@ products:
10
10
11
11
This page provides an overview of the relationship between the various certificates and certificate authorities (CAs) that you configure for {{fleet-server}} and {{agent}}, using the `elastic-agent install` TLS command options.
12
12
13
+
You can also configure one-way and mutual TLS connections using {{kib}}. {applies_to}`stack: ga 9.1`
Editing SSL or proxy settings for an existing {{fleet-server}} might cause agents to lose connectivity. After changing client certificate settings, you might need to re-enroll the affected agents.
0 commit comments