Skip to content

Commit 91072f3

Browse files
Add TLS/mTLS UI configuration options for Fleet Server (#2193)
This PR updates Fleet documentation pages to reflect new UI support for configuring TLS and mTLS settings.
1 parent 95ed479 commit 91072f3

File tree

3 files changed

+129
-14
lines changed

3 files changed

+129
-14
lines changed

reference/fleet/fleet-settings.md

Lines changed: 38 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ On the **Settings** tab in **Fleet**, you can configure global settings availabl
1818

1919
## {{fleet-server}} host settings [fleet-server-hosts-setting]
2020

21-
Click **Edit hosts** and specify the host URLs your {{agent}}s will use to connect to a {{fleet-server}}.
21+
Select **Edit hosts** and specify the host URLs your {{agent}}s will use to connect to a {{fleet-server}}.
2222

2323
::::{tip}
2424
If the **Edit hosts** option is grayed out, {{fleet-server}} hosts are configured outside of {{fleet}}. For more information, refer to [{{fleet}} settings in {{kib}}](kibana://reference/configuration-reference/fleet-settings.md).
@@ -49,7 +49,7 @@ The exposed ports must be open for ingress and egress in the firewall and networ
4949
::::
5050

5151

52-
Specify multiple URLs (click **Add row**) to scale out your deployment and provide automatic failover. If multiple URLs exist, {{fleet}} shows the first provided URL for enrollment purposes. Enrolled {{agent}}s will connect to the URLs in round robin order until they connect successfully.
52+
Specify multiple URLs (select **Add row**) to scale out your deployment and provide automatic failover. If multiple URLs exist, {{fleet}} shows the first provided URL for enrollment purposes. Enrolled {{agent}}s will connect to the URLs in round robin order until they connect successfully.
5353

5454
When a {{fleet-server}} is added or removed from the list, all agent policies are updated automatically.
5555

@@ -76,8 +76,8 @@ The {{ecloud}} internal output is locked and cannot be edited. This output is us
7676

7777
To add or edit an output:
7878

79-
1. Go to **{{fleet}} Settings**.
80-
2. Under **Outputs**, click **Add output** or **Edit**.
79+
1. Go to **{{fleet}} > Settings**.
80+
2. Under **Outputs**, select **Add output** or **Edit**.
8181

8282
:::{image} images/fleet-add-output-button.png
8383
:alt: {{fleet}} Add output button
@@ -93,7 +93,7 @@ To add or edit an output:
9393
* [Kafka output settings](/reference/fleet/kafka-output-settings.md)
9494
* [Remote {{es}} output](/reference/fleet/remote-elasticsearch-output.md)
9595

96-
5. Click **Save and apply settings**.
96+
5. Select **Save and apply settings**.
9797

9898
::::{tip}
9999
If the options for editing an output are grayed out, outputs are configured outside of {{fleet}}. For more information, refer to [{{fleet}} settings in {{kib}}](kibana://reference/configuration-reference/fleet-settings.md).
@@ -109,12 +109,42 @@ For {{agent}}s that cannot access the internet, you can specify agent binary dow
109109

110110
To add or edit the source of binary downloads:
111111

112-
1. Go to **{{fleet}} Settings**.
113-
2. Under **Agent Binary Download**, click **Add agent binary source** or **Edit**.
112+
1. Go to **{{fleet}} > Settings**.
113+
2. Under **Agent Binary Download**, select **Add agent binary source** or **Edit**.
114114
3. Set the agent binary source name.
115115
4. For **Host**, specify the address where you are hosting the artifacts repository.
116116
5. (Optional) To make this location the default, select **Make this host the default for all agent policies**. {{agent}}s use the default location if you don’t select a different agent binary source in the agent policy.
117117

118+
## Agent binary download settings [fleet-agent-binary-download-settings]
119+
120+
{{agent}}s must be able to access the {{artifact-registry}} to download binaries during upgrades. By default {{agent}}s download artifacts from the artifact registry at `https://artifacts.elastic.co/downloads/`.
121+
122+
For {{agent}}s that cannot access the internet, you can specify agent binary download settings, and then configure agents to download their artifacts from the alternate location. For more information about running {{agent}}s in a restricted environment, refer to [Air-gapped environments](/reference/fleet/air-gapped.md).
123+
124+
To add or edit the source of binary downloads:
125+
126+
1. Go to **{{fleet}} > Settings**.
127+
2. Under **Agent Binary Download**, select **Add agent binary source** or **Edit**.
128+
3. Set the agent binary source name.
129+
4. For **Host**, specify the address where you are hosting the artifacts repository.
130+
5. (Optional) To make this location the default, select **Make this host the default for all agent policies**. {{agent}}s use the default location if you don’t select a different agent binary source in the agent policy.
131+
132+
133+
### Configure SSL for binary downloads [agent-binary-ssl]
134+
```{applies_to}
135+
stack: ga 9.1
136+
```
137+
138+
You can optionally secure connections to your binary download source using TLS. These settings correspond to the certificates the agent uses when connecting to the download host.
139+
140+
The following SSL options are available when adding or editing an agent binary source:
141+
142+
| **UI Field** | **Purpose** |
143+
|------------------------|------------------------------------------------------------------------------|
144+
| Certificate authorities | Trusted CAs for verifying the server certificate. |
145+
| Certificate | Client certificate to use for mTLS authentication with the download host. |
146+
| Certificate key | Private key associated with the client certificate. |
147+
118148

119149
## Proxies [proxy-settings]
120150

@@ -129,5 +159,5 @@ Note that this option can also be enabled by adding the `xpack.fleet.enableDelet
129159

130160
To enable automatic deletion of unenrolled agents:
131161

132-
1. Go to **{{fleet}} Settings**.
162+
1. Go to **{{fleet}} > Settings**.
133163
2. Under **Advanced Settings**, enable the **Delete unenrolled agents** option.

reference/fleet/secure-connections.md

Lines changed: 42 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ When you run {{agent}} with the {{elastic-defend}} integration, the [TLS certifi
4242
::::
4343

4444

45-
4645
## Generate a custom certificate and private key for {{fleet-server}} [generate-fleet-server-certs]
4746

4847
This section describes how to use the `certutil` tool provided by {{es}}, but you can use whatever process you typically use to generate PEM-formatted certificates.
@@ -84,8 +83,11 @@ This section describes how to use the `certutil` tool provided by {{es}}, but yo
8483
Store the files in a secure location. You’ll need these files later to encrypt traffic between {{agent}}s and {{fleet-server}}.
8584

8685

86+
## Configure SSL/TLS using CLI [fleet-server-ssl-cli-settings]
87+
88+
Use the CLI to configure SSL or TLS when installing or enrolling {{fleet-server}}. This method gives you granular control over certificate paths, verification modes, and authentication behavior.
8789

88-
## Encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}} [_encrypt_traffic_between_agents_fleet_server_and_es]
90+
### Encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}} [_encrypt_traffic_between_agents_fleet_server_and_es]
8991

9092
{{fleet-server}} needs a CA certificate or the CA fingerprint to connect securely to {{es}}. It also needs to expose a {{fleet-server}} certificate so other {{agent}}s can connect to it securely.
9193

@@ -101,15 +103,15 @@ For the steps in this section, imagine you have the following files:
101103
To encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}}:
102104

103105
1. Configure {{fleet}} settings. These settings are applied to all {{fleet}}-managed {{agent}}s.
104-
2. In {{kib}}, open the main menu, then click **Management > {{fleet}} > Settings**.
106+
2. In {{kib}}, open the main menu, then select **Management > {{fleet}} > Settings**.
105107

106108
1. Under **{{fleet-server}} hosts**, specify the URLs {{agent}}s will use to connect to {{fleet-server}}. For example, [https://192.0.2.1:8220](https://192.0.2.1:8220), where 192.0.2.1 is the host IP where you will install {{fleet-server}}.
107109

108110
::::{tip}
109111
For host settings, use the `https` protocol. DNS-based names are also allowed.
110112
::::
111113

112-
2. Under **Outputs**, search for the default output, then click the **Edit** icon in the **Action** column.
114+
2. Under **Outputs**, search for the default output, then select the **Edit** icon in the **Action** column.
113115
3. In the **Hosts** field, specify the {{es}} URLs where {{agent}}s will send data. For example, [https://192.0.2.0:9200](https://192.0.2.0:9200).
114116
4. Specify either a CA certificate or CA fingerprint to connect securely {{es}}:
115117

@@ -156,7 +158,7 @@ To encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}}:
156158

157159
1. Install an {{agent}} as a {{fleet-server}} on the host and configure it to use TLS:
158160

159-
1. If you don’t already have a {{fleet-server}} service token, click the **Agents** tab in {{fleet}} and follow the instructions to generate the service token now.
161+
1. If you don’t already have a {{fleet-server}} service token, select the **Agents** tab in {{fleet}} and follow the instructions to generate the service token now.
160162

161163
::::{tip}
162164
The in-product installation steps are incomplete. Before running the `install` command, add the settings shown in the next step.
@@ -268,6 +270,40 @@ To encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}}:
268270
`certificate-authorities`
269271
: CA certificate to use to connect to {{fleet-server}}. This is the CA used to [generate a certificate and key](#generate-fleet-server-certs) for {{fleet-server}}.
270272

271-
Don’t have an enrollment token? On the **Agents** tab in {{fleet}}, click **Add agent**. Under **Enroll and start the Elastic Agent**, follow the in-product installation steps, making sure that you add the `--certificate-authorities` option before you run the command.
273+
Don’t have an enrollment token? On the **Agents** tab in {{fleet}}, select **Add agent**. Under **Enroll and start the Elastic Agent**, follow the in-product installation steps, making sure that you add the `--certificate-authorities` option before you run the command.
274+
275+
276+
## Configure SSL/TLS using {{kib}} [fleet-server-ssl-ui-settings]
277+
```{applies_to}
278+
stack: ga 9.1
279+
```
280+
281+
You can configure SSL/TLS settings for {{fleet-server}} hosts directly in the {{fleet}} UI, without relying on CLI flags or policy overrides.
282+
283+
To access these settings:
284+
285+
1. In **Kibana**, go to **Management > {{fleet}} > Settings**.
286+
2. Under **{{fleet-server}} hosts**, select **Add host** or edit an existing host.
287+
3. Expand the **SSL options** section.
288+
289+
### SSL options
290+
291+
These are the available UI fields and their CLI equivalents:
292+
293+
The following table shows the available UI fields and their CLI equivalents:
294+
295+
| **UI Field** | **CLI Flag** | **Purpose** |
296+
| ------------------------------------- | ---------------------------- | -------------------------------------------------------------------- |
297+
| Server SSL certificate authorities | `--certificate-authorities` | CA to validate agent certificates (Fleet Server authenticates agent) |
298+
| Client SSL certificate | `--fleet-server-cert` | TLS certificate Fleet Server presents to agent (agent validates it) |
299+
| Client SSL certificate key | `--fleet-server-cert-key` | Key paired with the Fleet Server client certificate |
300+
| Elasticsearch certificate authorities | `--fleet-server-es-ca` | CA Fleet Server uses to validate Elasticsearch cert |
301+
| SSL certificate for Elasticsearch | `--fleet-server-es-cert` | Fleet Server’s mTLS certificate for Elasticsearch |
302+
| SSL certificate key for Elasticsearch | `--fleet-server-es-cert-key` | Key paired with the Fleet Server’s Elasticsearch certificate |
303+
| Enable client authentication | `--fleet-server-client-auth` | Require agents to present client certificates (mTLS only) |
272304

305+
:::{warning}
306+
Editing SSL or proxy settings for an existing {{fleet-server}} might cause agents to lose connectivity. After changing client certificate settings, you might need to re-enroll the affected agents.
307+
:::
273308

309+
To configure a mutual TLS connection from {{fleet-server}} to {{es}}, use the {{es}} output settings. For more information, refer to [Output SSL options](/reference/fleet/tls-overview.md#output-ssl-options).

reference/fleet/tls-overview.md

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,11 @@ products:
1010

1111
This page provides an overview of the relationship between the various certificates and certificate authorities (CAs) that you configure for {{fleet-server}} and {{agent}}, using the `elastic-agent install` TLS command options.
1212

13+
You can also configure one-way and mutual TLS connections using {{kib}}. {applies_to}`stack: ga 9.1`
14+
1315
* [Simple one-way TLS connection](#one-way-tls-connection)
1416
* [Mutual TLS connection](#mutual-tls-connection)
17+
* [Configure TLS/mTLS settings in {{kib}}](#tls-ui-settings) {applies_to}`stack: ga 9.1`
1518

1619

1720
## Simple one-way TLS connection [one-way-tls-connection]
@@ -97,3 +100,49 @@ Note that you can also configure mutual TLS for {{fleet-server}} and {{agent}} [
97100
:alt: Diagram of mutual TLS connection between components
98101
:::
99102

103+
## Configure TLS/mTLS settings in the Fleet UI [tls-ui-settings]
104+
```{applies_to}
105+
stack: ga 9.1
106+
```
107+
108+
You can configure TLS and mutual TLS (mTLS) settings for {{fleet-server}} and outputs using the {{fleet}} UI.
109+
110+
### Fleet Server SSL options
111+
112+
To access these settings:
113+
114+
1. In **Kibana**, go to **Management > {{fleet}} > Settings**.
115+
2. Under **Fleet Server hosts**, select **Add host** or edit an existing host.
116+
3. Expand the **SSL options** or **Authentication** section.
117+
118+
The following table shows the available UI fields and their CLI equivalents:
119+
120+
| **UI Field** | **CLI Flag** | **Purpose** |
121+
| ------------------------------------- | ---------------------------- | -------------------------------------------------------------------- |
122+
| Server SSL certificate authorities | `--certificate-authorities` | CA to validate agent certificates (Fleet Server authenticates agent) |
123+
| Client SSL certificate | `--fleet-server-cert` | TLS certificate Fleet Server presents to agent (agent validates it) |
124+
| Client SSL certificate key | `--fleet-server-cert-key` | Key paired with the Fleet Server client certificate |
125+
| Elasticsearch certificate authorities | `--fleet-server-es-ca` | CA Fleet Server uses to validate Elasticsearch cert |
126+
| SSL certificate for Elasticsearch | `--fleet-server-es-cert` | Fleet Server’s mTLS certificate for Elasticsearch |
127+
| SSL certificate key for Elasticsearch | `--fleet-server-es-cert-key` | Key paired with the Fleet Server’s Elasticsearch certificate |
128+
| Enable client authentication | `--fleet-server-client-auth` | Require agents to present client certificates (mTLS only) |
129+
130+
### Output SSL options
131+
132+
To access these settings:
133+
134+
1. In **Kibana**, go to **Management > {{fleet}} > Settings**.
135+
2. Under **Outputs**, select **Add output** or edit an existing output.
136+
3. Expand the **SSL options** or **Authentication** section.
137+
138+
These apply to {{es}} and Remote {{es}} only, and are only necessary when setting up an mTLS connection:
139+
140+
| **UI Field** | **CLI Flag** | **Purpose** |
141+
| ---------------------------------- | --------------------------- | ---------------------------------------------------------------- |
142+
| Server SSL certificate authorities | `--certificate-authorities` | CA the agent uses to verify the output’s TLS certificate |
143+
| Client SSL certificate | `--elastic-agent-cert` | Certificate used by agent to authenticate with output (for mTLS) |
144+
| Client SSL certificate key | `--elastic-agent-cert-key` | Key paired with agent mTLS certificate |
145+
146+
:::{warning}
147+
Editing SSL or proxy settings for an existing {{fleet-server}} might cause agents to lose connectivity. After changing client certificate settings, you might need to re-enroll the affected agents.
148+
:::

0 commit comments

Comments
 (0)