From 9cec79b2992b0ae6f402287abddf9ca314258a85 Mon Sep 17 00:00:00 2001 From: reyesj2 <94730068+reyesj2@users.noreply.github.com> Date: Tue, 28 Apr 2026 13:34:39 -0500 Subject: [PATCH] check current fleet policy cert against cert on disk Co-authored-by: Copilot --- .../tools/sbin_jinja/so-elastic-fleet-outputs-update | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-outputs-update b/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-outputs-update index f045bf753..8630799d8 100644 --- a/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-outputs-update +++ b/salt/elasticfleet/tools/sbin_jinja/so-elastic-fleet-outputs-update @@ -235,6 +235,16 @@ function update_kafka_outputs() { {% endif %} +# Compare the current Elastic Fleet certificate against what is on disk +POLICY_CERT_SHA=$(jq -r '.item.ssl.certificate' <<< $RAW_JSON | openssl x509 -noout -sha256 -fingerprint) +DISK_CERT_SHA=$(openssl x509 -in /etc/pki/elasticfleet-logstash.crt -noout -sha256 -fingerprint) + +if [[ "$POLICY_CERT_SHA" != "$DISK_CERT_SHA" ]]; then + printf "Certificate on disk doesn't match certificate in policy - forcing update\n" + UPDATE_CERTS=true + FORCE_UPDATE=true +fi + # Sort & hash the new list of Logstash Outputs NEW_LIST_JSON=$(jq --compact-output --null-input '$ARGS.positional' --args -- "${NEW_LIST[@]}") NEW_HASH=$(sha256sum <<< "$NEW_LIST_JSON" | awk '{print $1}')