Add TLS/mTLS UI configuration options for Fleet Server #2193
Conversation
🔍 Preview links for changed docs |
| | **UI Field** | **CLI Flag** | **Purpose** | | ||
| |--------------------------------------------------|---------------------------------------|-------------| | ||
| | Client SSL Certificate | `--elastic-agent-cert` | {{agent}} client certificate to use with {{fleet-server}} during mTLS authentication. | | ||
| | Client SSL Certificate key | `--elastic-agent-cert-key` | {{agent}} client private key to use with {{fleet-server}} during mTLS authentication. This field uses secret storage and requires {{fleet-server}} v8.12.0 or later. You can optionally choose to store the value as plain text instead. | |
There was a problem hiding this comment.
I think that the these should be -fleet-server-es-cert and -fleet-server-es-cert-key. The --elastic-agent-cert are the ones available under the output section of fleet settings
|
|
||
| The {{fleet}} UI doesn't currently allow editing the {{fleet-server}}’s own exposed TLS certificate (`--fleet-server-cert`, `--fleet-server-cert-key`). These are only configurable using the CLI either during the initial installation or later. |
There was a problem hiding this comment.
I'm confused by this sentence, I don't think it should be here. These values should be in the table above.
|
|
||
| :::{warning} | ||
| Editing SSL or proxy settings for an existing {{fleet-server}} might cause agents to lose connectivity. After changing client certificate settings, you need to re-enroll the affected agents. |
There was a problem hiding this comment.
you need to re-enroll the affected agents - I'm not 100% sure about this. I would replace it with
you might need to re-enroll the affected agents
reference/fleet/tls-overview.md
Outdated
| 2. Under **Fleet Server hosts**, select **Add host** or edit an existing host. | ||
| 3. Expand the **SSL options** section. | ||
|
|
||
| ### SSL options |
There was a problem hiding this comment.
I see where the mix up is - the elastic-agent-cert and --elastic-agent-cert-key are the ones available under Fleet settings > output . We should point the user to that section if they want to set up a mTLS connection
This PR updates Fleet documentation pages to reflect new UI support for configuring TLS and mTLS settings.