Currently, it's possible to enroll the Agent without using a TLS connection, you only need to use the "HTTP" protocol when enrolling. Since the Agent can be effectively controlled by a remote kibana instance we want to enforce the requirement of TLS and refuse to enroll if the Kibana endpoint doesn't have TLS enabled.

It should fail when using the following to enroll

agent enroll http://localhost:5901 <enroll_key>

You can disable the TLS requirement by using the -insecure, using this flag should warn the user that the connection is insecure and this flag should not be used in production.

agent enroll -insecure http://localhost:5901 <enroll_key>