Skip to content

Commit f9b079d

Browse files
leehinmankilfoyle
leehinman
and
kilfoyle
authored
Add documentation for elastic-agent-cert-key-passphrase option (#1413)
* Add documentation for elastic-agent-cert-key-passphrase option * Add the setting throughout the docs * Update docs/en/ingest-management/security/certificates.asciidoc * Update docs/en/ingest-management/commands.asciidoc * Update docs/en/ingest-management/commands.asciidoc * Update docs/en/ingest-management/elastic-agent/configuration/env/shared-env.asciidoc * Update docs/en/ingest-management/security/certificates.asciidoc --------- Co-authored-by: David Kilfoyle <david.kilfoyle@elastic.co> Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com>
1 parent f5344bf commit f9b079d

6 files changed

Lines changed: 45 additions & 0 deletions

File tree

‎docs/en/ingest-management/commands.asciidoc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ elastic-agent enroll --url <string>
164164
[--delay-enroll]
165165
[--elastic-agent-cert <string>]
166166
[--elastic-agent-cert-key <string>]
167+
[--elastic-agent-cert-key-passphrase <string>]
167168
[--force]
168169
[--header <strings>]
169170
[--help]
@@ -191,6 +192,7 @@ elastic-agent enroll --fleet-server-es <string>
191192
[--delay-enroll]
192193
[--elastic-agent-cert <string>]
193194
[--elastic-agent-cert-key <string>]
195+
[--elastic-agent-cert-key-passphrase <string>]
194196
[--fleet-server-cert <string>] <1>
195197
[--fleet-server-cert-key <string>]
196198
[--fleet-server-cert-key-passphrase <string>]
@@ -251,6 +253,12 @@ Certificate to use as the client certificate for the {agent}'s connections to {f
251253
`--elastic-agent-cert-key`::
252254
Private key to use as for the {agent}'s connections to {fleet-server}.
253255

256+
`--elastic-agent-cert-key-passphrase`::
257+
The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}.
258+
The file must only contain the characters of the passphrase, no newline or extra non-printing characters.
259+
+
260+
This option is only used if the `--elastic-agent-cert-key` is encrypted and requires a passphrase to use.
261+
254262
`--enrollment-token <string>`::
255263
Enrollment token to use to enroll {agent} into {fleet}. You can use
256264
the same enrollment token for multiple agents.
@@ -580,6 +588,7 @@ elastic-agent install --url <string>
580588
[--delay-enroll]
581589
[--elastic-agent-cert <string>]
582590
[--elastic-agent-cert-key <string>]
591+
[--elastic-agent-cert-key-passphrase <string>]
583592
[--force]
584593
[--header <strings>]
585594
[--help]
@@ -611,6 +620,7 @@ elastic-agent install --fleet-server-es <string>
611620
[--delay-enroll]
612621
[--elastic-agent-cert <string>]
613622
[--elastic-agent-cert-key <string>]
623+
[--elastic-agent-cert-key-passphrase <string>]
614624
[--fleet-server-cert <string>] <1>
615625
[--fleet-server-cert-key <string>]
616626
[--fleet-server-cert-key-passphrase <string>]
@@ -679,6 +689,12 @@ Certificate to use as the client certificate for the {agent}'s connections to {f
679689
`--elastic-agent-cert-key`::
680690
Private key to use as for the {agent}'s connections to {fleet-server}.
681691

692+
`--elastic-agent-cert-key-passphrase`::
693+
The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}.
694+
The file must only contain the characters of the passphrase, no newline or extra non-printing characters.
695+
+
696+
This option is only used if the `--elastic-agent-cert-key` is encrypted and requires a passphrase to use.
697+
682698
`--enrollment-token <string>`::
683699
Enrollment token to use to enroll {agent} into {fleet}. You can use
684700
the same enrollment token for multiple agents.

‎docs/en/ingest-management/elastic-agent/configuration/env/container-envs.asciidoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,8 @@ include::shared-env.asciidoc[tag=elastic-agent-cert]
149149

150150
include::shared-env.asciidoc[tag=elastic-agent-cert-key]
151151

152+
include::shared-env.asciidoc[tag=elastic-agent-cert-key-passphrase]
153+
152154
include::shared-env.asciidoc[tag=elastic-agent-tag]
153155

154156
include::shared-env.asciidoc[tag=fleet-enroll]

‎docs/en/ingest-management/elastic-agent/configuration/env/shared-env.asciidoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,18 @@ OPTIONAL INFO AND EXAMPLE
3737

3838
// end::elastic-agent-cert-key[]
3939

40+
// tag::elastic-agent-cert-key-passphrase[]
41+
|
42+
[id="env-{type}-elastic-agent-cert-key-passphrase"]
43+
`ELASTIC_AGENT_CERT_KEY_PASSPHRASE`
44+
45+
| (string) The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}.
46+
The file must only contain the characters of the passphrase, no newline or extra non-printing characters.
47+
48+
This option is only used if the `--elastic-agent-cert-key` is encrypted and requires a passphrase to use.
49+
50+
// end::elastic-agent-cert-key-passphrase[]
51+
4052
// =============================================================================
4153

4254
// tag::elastic-agent-tag[]

‎docs/en/ingest-management/security/certificates.asciidoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -231,6 +231,7 @@ sudo ./elastic-agent install \
231231
--fleet-server-port=8220 \
232232
--elastic-agent-cert=/tmp/fleet-server.crt \
233233
--elastic-agent-cert-key=/tmp/fleet-server.key \
234+
--elastic-agent-cert-key-passphrase=/tmp/fleet-server/passphrase-file \
234235
--fleet-server-es-cert=/tmp/fleet-server.crt \
235236
--fleet-server-es-cert-key=/tmp/fleet-server.key \
236237
--fleet-server-client-auth=required
@@ -263,6 +264,10 @@ to the other {agents}
263264
The certificate to use as the client certificate for {agent}'s connections to {fleet-server}.
264265
`elastic-agent-cert-key`::
265266
The path to the private key to use as for {agent}'s connections to {fleet-server}.
267+
`elastic-agent-cert-key`::
268+
The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}.
269+
The file must only contain the characters of the passphrase, no newline or extra non-printing characters.
270+
This option is only used if the `elastic-agent-cert-key` is encrypted and requires a passphrase to use.
266271
`fleet-server-es-cert`::
267272
The path to the client certificate that {fleet-server} will use when connecting to {es}.
268273
`fleet-server-es-cert-key`::

‎docs/en/ingest-management/security/mutual-tls.asciidoc‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ During {agent} installation on premise use the following options:
7272
7373
|`--elastic-agent-cert-key`
7474
|{agent} certificate key to present to {fleet-server}
75+
76+
|`--elastic-agent-cert-key-passphrase`
77+
|The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}
7578
|===
7679
7780
[discrete]
@@ -183,6 +186,9 @@ During {agent} installation on premise use the following options:
183186
184187
|`--elastic-agent-cert-key`
185188
|{agent}'s private certificate key used to decrypt the certificate
189+
190+
|`--elastic-agent-cert-key-passphrase`
191+
|The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}
186192
|===
187193
188194
[discrete]
@@ -213,6 +219,9 @@ During {agent} installation on premise use the following options, similar to <<m
213219
214220
|`--elastic-agent-cert-key`
215221
|{agent}'s private certificate key used to decrypt the certificate
222+
223+
|`--elastic-agent-cert-key-passphrase`
224+
|The path to the file that contains the passphrase for the mutual TLS private key that {agent} will use to connect to {fleet-server}
216225
|===
217226
218227
[discrete]

‎docs/en/ingest-management/security/tls-overview.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ elastic-agent install --url=https://your-fleet-server.elastic.co:443 \
5252
--certificate-authorities=/path/to/fleet-ca,/path/to/agent-ca \
5353
--elastic-agent-cert=/path/to/agent-cert \
5454
--elastic-agent-cert-key=/path/to/agent-cert-key \
55+
--elastic-agent-cert-key=/path/to/agent-cert-key-passphrase \
5556
--fleet-server-es=https://es.elastic.com:443 \
5657
--fleet-server-es-ca=/path/to/es-ca \
5758
--fleet-server-es-cert=/path/to/fleet-es-cert \

0 commit comments

Comments
 (0)