Document how to configure advanced SSL/TLS settings for the Fleet Server integration - #7657
Document how to configure advanced SSL/TLS settings for the Fleet Server integration#7657vishaangelova wants to merge 5 commits into
Conversation
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
🔍 Preview links for changed docs⏳ Building and deploying preview... View progress This comment will be updated with preview links when the build is complete. |
Co-authored-by: Cursor <cursoragent@cursor.com>
c5d911f to
a167fd8
Compare
|
Hey @ebeahan, could you direct me to an SME who can review the changes in this PR? Thank you! 🙏 |
vishaangelova
changed the title
Co-authored-by: Cursor <cursoragent@cursor.com>
450ac0f to
bf4ddc8
Compare
Add section headings for the common, client, and server SSL option groups, clarify the intro that explains when each group applies, fix a typo, and point the secure-connections cross-link at the new anchor. Co-authored-by: Cursor <cursoragent@cursor.com>
bf4ddc8 to
6398968
Compare
alexandra5000
left a comment
alexandra5000
left a comment
There was a problem hiding this comment.
Hey, thanks for adding this! I left some comments / open-ended questions, none blocking
| ```yaml | ||
| server: | ||
| ssl: | ||
| enabled: true |
There was a problem hiding this comment.
You'd need an SMEs confirmation, but I don't think you can even change it to false (and you wouldn't be able to enroll agents). I see why it's included here but maybe worth adding a small comment that the value is true by default and cannot be changed? For example:
| enabled: true | |
| enabled: true # always required; don't set to false |
There was a problem hiding this comment.
@AndersonQ can you help with this? Is this even needed here? If yes, is it truly immutable, would it break enrollment if set to false?
4 participants
Summary
Documents how to configure the Fleet Server input's SSL/TLS settings (
cipher_suites,supported_protocols, and otherserver.ssloptions) using the Fleet Server integration policy's advanced YAML, adds a connectivity-risk warning, and clarifies that these settings have noelastic-agent installCLI flags.Resolves #3573
Changes
reference/fleet/secure-connections.md(primary): New "Configure advanced SSL/TLS settings for Fleet Server" section explaining thatsupported_protocolsandcipher_suitesaren't exposed as UI fields or install flags and must be set using aserver.sslblock in the Fleet Server integration policy's Custom fleet-server configurations (Advanced options).Includes the UI procedure, a YAML example, default behavior, a link to the full settings reference, and a connectivity-risk warning. Also adds a note in the CLI section clarifying no install flags exist for these settings.
reference/fleet/fleet-server-scalability.md: Adds a pointer from the "Advanced Fleet Server options" section to the new section.reference/fleet/elastic-agent-ssl-configuration.md: Adds a note at the server SSL options that these settings also apply to the Fleet Server input underserver.ssl, linking to the new section.Verification
Content was verified against the codebase in the
kibana,integrations,fleet-server, andelastic-agent-libsrepos:fleet_serverpackage exposes acustomYAML var that passesserver.sslthrough verbatim.fleet-server'sserver.sslmaps totlscommon.ServerConfig, and the defaultsupported_protocols(TLSv1.2,TLSv1.3) and cipher suite list match the documented reference values.Generative AI disclosure
Tool(s) and model(s) used: Cursor / Claude Opus 4.8 High