Victor Lyuboslavsky
e1094096af
Windows configuration profiles that Fleet proxies SCEP for previously reported "verified" as soon as the device acknowledged the SyncML Exec command, even when the asynchronous SCEP exchange later failed and no certificate was ever issued. - Proxied SCEP profiles (custom SCEP proxy, NDES) now move to "verifying" on the device ACK and only reach "verified" once Fleet observes the matching certificate on the host, keyed by the renewal-ID marker (fleet-<profile_uuid>) in the certificate CN/OU. - When Fleet's SCEP proxy observes an upstream CA error during PKIOperation, it marks the profile "failed" with a detail naming the operation and upstream status. If the device's own retry later succeeds, the observed certificate flips the profile to "verified". - Unconfirmed profiles stay "verifying" (offline host, agent that cannot enumerate certificates, empty store, or a user-scoped profile before the user logs in); absence is never treated as failure. <!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #45550 Demo: https://www.youtube.com/watch?v=WNGuFdeBmzA Docs: https://github.com/fleetdm/fleet/pull/48933/changes # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Timeouts are implemented and retries are limited to avoid infinite loops ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit * **New Features** * Added Windows SCEP failure tracking with clearer, categorized detail when upstream operations fail. * Added reconciliation backstops for “stuck” proxied SCEP profiles, including automatic recovery to verified when the expected certificate is observed. * **Bug Fixes** * Prevented proxied Windows SCEP installs from being marked “verified” until matching certificate evidence arrives. * Improved classification and persistence behavior for timeouts, connection/DNS issues, and HTTP error responses without disturbing existing retry state. * **Tests** * Expanded Windows SCEP scenarios to cover reconciliation, skipping conditions, and error classification. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
494 B
494 B
- Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).