Elastic Agent imbeded x509 for host url certificate only recognizes host name not. full url is there a way to only regenerate the new Elastic Agents

[Bal33p]

SO 2.4 beta 3 "I think" I am not. using an ISO I ran from the 2.4/main GitHub, installed today 6-2-23
Standalone
Oracle Rocky 9.2 Linux minimal
The Fleet server is configured but I do not have an agent installed on the server and so I do not see the ohst agent with grid-nodes policy attached.

timestamp=2023-06-02T18:37:51.996069007Z level=info message="Version Information" ElasticAgentVersion=8.7.0 WrapperVersion=2.4.2 timestamp=2023-06-02T18:37:51.996195013Z level=info message="Runtime Data" EnrollmentToken="LUJKR2ZZZ0Jhbms2TkN2VUNNUjg6empYM1NnLVhRVm1jYm12ZDVOM0JPdw==" FleetURL/s=https://orseconp02.redacted.com:8220,https://172.24.2.220:8220 timestamp=2023-06-02T18:37:51.996203749Z level=info message="Installation Progress" Status="Starting Installation Precheck" timestamp=2023-06-02T18:37:52.007444406Z level=info message="Installation Progress" FleetHostConnectivityCheck=Success FleetHostURL=https://orseconp02.redacted.com:8220 timestamp=2023-06-02T18:37:52.007466909Z level=info message="Installation Progress" Status="Fleet Host is accessible - Continuing installation" timestamp=2023-06-02T18:37:52.007473521Z level=info message="Installation Progress" Status="Installation Precheck Complete" timestamp=2023-06-02T18:37:52.007478581Z level=info message="Installation Progress" Status="Extracting Elastic Agent files" timestamp=2023-06-02T18:37:55.942980237Z level=info message="Installation Progress" Status="Executing Elastic Agent installer" timestamp=2023-06-02T18:37:55.943027385Z level=info message="Installation Progress" Status="Executing the following: ./so-elastic-agent_source/elastic-agent/elastic-agent install --url=https://orseconp02.redacted.com:8220 --enrollment-token=LUJKR2ZZZ0Jhbms2TkN2VUNNUjg6empYM1NnLVhRVm1jYm12ZDVOM0JPdw== --certificate-authorities=/opt/Elastic/SO/soca.crt -n" timestamp=2023-06-02T18:38:11.76132811Z level=error message="Installation Progress" Context="Installing in non-interactive mode.{\"log.level\":\"info\",\"@timestamp\":\"2023-06-02T18:38:05.570Z\",\"log.origin\":{\"file.name\":\"cmd/enroll_cmd.go\",\"file.line\":475},\"message\":\"Starting enrollment to URL: [https://orseconp02.redacted.com:8220/\",\"ecs.version\":\"1.6.0\"}\nError](https://orseconp02.redacted.com:8220/%22,/%22ecs.version/%22:/%221.6.0/%22%7d/nError): fail to enroll: fail to execute request to fleet-server: x509: certificate is valid for orseconp02, not orseconp02.redacted.com\nFor help, please see our troubleshooting guide at [https://www.elastic.co/guide/en/fleet/8.7/fleet-troubleshooting.html\nError](https://www.elastic.co/guide/en/fleet/8.7/fleet-troubleshooting.html/nError): enroll command failed with exit code: 1\nFor help, please see our troubleshooting guide at [https://www.elastic.co/guide/en/fleet/8.7/fleet-troubleshooting.html\n](https://www.elastic.co/guide/en/fleet/8.7/fleet-troubleshooting.html/n)" ErrorDetails="exit status 1"

[defensivedepth]

Ah yes, I believe this is because the cert generation is not using the url_base. I have created an issue to fix it: #10510

[bleschber]

Same issue here. Any workaround while we wait for a fix?

Issue popped up for me at the end of a fresh install setup using 2.4.2-20230531 ISO image built on 2023/05/31

[defensivedepth]

Can you all confirm that you selected Other during setup?

[bleschber]

In my case, yes, I selected OTHER.

[defensivedepth]

@bleschber Do you still have access to this failed install? If so, can you run the following from the command line and post sanitized results?

sudo salt-call pillar.get global

[Bal33p]

local: ---------- airgap: False endgamehost: fleet_grid_enrollment_token: Token ids: Suricata imagerepo: security-onion-solutions influxdb_host: orseconp02 managerip: 172.24.2.220 mdengine: ZEEK pipeline: redis registry_host: orseconp02 repo_host: orseconp02 soversion: 2.4.2 url_base: orseconp02.redacted.com

[Bal33p]

Confirmed, I did select Other