Document how to configure advanced SSL/TLS settings for the Fleet Server integration

reference/fleet/elastic-agent-ssl-configuration.md

@@ -13,16 +13,18 @@ products:
 # Configure SSL/TLS for standalone {{agent}}s [elastic-agent-ssl-configuration]
 
 
-There are a number of SSL configuration settings available depending on whether you are configuring a client, server, or both. See the following tables for available settings:
+Use these settings to configure SSL/TLS for a standalone {{agent}}. The available settings depend on whether {{agent}} acts as a client, a server, or both:
 
-* [Table 7, Common configuration options](#common-ssl-options). These settings are valid in both client and server configurations.
-* [Table 8, Client configuration options](#client-ssl-options)
-* [Table 9, Server configuration options](#server-ssl-options)
+* [Common configuration options](#common-ssl-config-options): Valid in both client and server configurations.
+* [Client configuration options](#client-ssl-config-options): Apply when {{agent}} connects to a server.
+* [Server configuration options](#server-ssl-config-options): Apply when {{agent}} accepts incoming connections.
 
 ::::{tip}
 For more information about using certificates, refer to [Secure connections](/reference/fleet/secure.md).
 ::::
 
+## Common configuration options [common-ssl-config-options]
+
 $$$common-ssl-options$$$
 
 `ssl.ca_sha256` $$$ssl.ca_sha256-common-setting$$$
@@ -100,6 +102,8 @@ $$$common-ssl-options$$$
 
     **Default:** `[TLSv1.2, TLSv1.3]`
 
+## Client configuration options [client-ssl-config-options]
+
 $$$client-ssl-options$$$
 
 `ssl.certificate` $$$ssl.certificate-client-setting$$$
@@ -206,8 +210,14 @@ $$$client-ssl-options$$$
     ssl.ca_trusted_fingerprint: 3b24d33844d6553...826
     ```
 
+## Server configuration options [server-ssl-config-options]
+
 $$$server-ssl-options$$$
 
+::::{tip}
+The following server configuration options also apply to the {{fleet-server}} HTTPS endpoint. To set them for a {{fleet}}-managed {{fleet-server}}, add them under a `server.ssl` block in the {{fleet-server}} integration policy. For more information, refer to [Configure advanced SSL/TLS settings for {{fleet-server}}](/reference/fleet/secure-connections.md#fleet-server-advanced-ssl-settings).
+::::
+
 `ssl.certificate` $$$ssl.certificate-server-setting$$$
 :   (string) The path to the certificate for SSL server authentication. If the certificate is not specified, startup will fail.
 

reference/fleet/fleet-server-scalability.md

@@ -70,6 +70,10 @@ The following advanced settings are available to fine tune your {{fleet-server}}
 You can't configure agent offline detection through these settings. An agent is marked offline after it stops checking in with {{fleet-server}} for 5 minutes. This threshold is fixed and can't be changed.
 ::::
 
+::::{tip}
+To fine tune the SSL/TLS settings of the {{fleet-server}} HTTPS endpoint, such as the allowed TLS versions (`server.ssl.supported_protocols`) and cipher suites (`server.ssl.cipher_suites`), refer to [Configure advanced SSL/TLS settings for {{fleet-server}}](/reference/fleet/secure-connections.md#fleet-server-advanced-ssl-settings).
+::::
+
 `cache`
 :   `num_counters`
 :   Size of the hash table. Best practice is to have this set to 10 times the max connections.

reference/fleet/secure-connections.md

@@ -95,6 +95,10 @@ This section describes how to use the `certutil` tool provided by {{es}}, but yo
 
 Use the CLI to configure SSL or TLS when installing or enrolling {{fleet-server}}. This method gives you granular control over certificate paths, verification modes, and authentication behavior.
 
+::::{note}
+The `install` command covers certificates, certificate authorities, keys, and client authentication, but not the allowed TLS versions (`supported_protocols`) or cipher suites (`cipher_suites`). To configure those, refer to [Configure advanced SSL/TLS settings for {{fleet-server}}](#fleet-server-advanced-ssl-settings).
+::::
+
 ### Encrypt traffic between {{agent}}s, {{fleet-server}}, and {{es}} [_encrypt_traffic_between_agents_fleet_server_and_es]
 
 {{fleet-server}} needs a CA certificate or the CA fingerprint to connect securely to {{es}}. It also needs to expose a {{fleet-server}} certificate so other {{agent}}s can connect to it securely.
@@ -317,3 +321,39 @@ Editing SSL or proxy settings for an existing {{fleet-server}} might cause agent
 :::
 
 To configure a mutual TLS connection from {{fleet-server}} to {{es}}, use the {{es}} output settings. For more information, refer to [Output SSL options](/reference/fleet/tls-overview.md#output-ssl-options).
+
+## Configure advanced SSL/TLS settings for {{fleet-server}} [fleet-server-advanced-ssl-settings]
+
+The {{fleet}} UI and the `elastic-agent install` command cover the most common SSL/TLS settings, such as certificates, certificate authorities, and client authentication. Granular options like the allowed TLS versions (`supported_protocols`) and cipher suites (`cipher_suites`) aren't exposed as UI fields or install command flags. To set them, add a `server.ssl` block to the {{fleet-server}} integration policy's advanced YAML configuration. {{fleet-server}} applies these settings to the HTTPS endpoint that {{agents}} connect to.
+
+To edit the advanced YAML configuration:
+
+1. Find {{fleet}} in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md).
+2. Select the **Agent policies** tab, then select the policy that runs {{fleet-server}}.
+3. Open the **Actions** menu {icon}`ellipsis` for the {{fleet-server}} integration, and select **Edit integration**.
+4. Expand **Advanced options** in the **Fleet Server** section.
+5. In the **Custom fleet-server configurations** field, add a `server.ssl` block with the required SSL configurations. For example:
+
+    ```yaml
+    server:
+      ssl:
+        enabled: true
+        supported_protocols:
+          - TLSv1.2
+          - TLSv1.3
+        cipher_suites:
+          - ECDHE-RSA-AES-256-GCM-SHA384
+          - ECDHE-RSA-AES-128-GCM-SHA256
+          - ECDHE-ECDSA-AES-256-GCM-SHA384
+          - ECDHE-ECDSA-AES-128-GCM-SHA256
+    ```
+
+6. Save the integration to roll out the updated policy to your {{fleet-server}}s.
+
+If you omit `supported_protocols`, {{fleet-server}} allows `TLSv1.2` and `TLSv1.3`. If you omit `cipher_suites`, the default cipher suites are used. TLS 1.3 cipher suites can't be configured individually.
+
+For the full list of SSL settings and their allowed values, refer to the server configuration options in [Configure SSL/TLS for standalone {{agents}}](/reference/fleet/elastic-agent-ssl-configuration.md#server-ssl-config-options).
+
+:::{warning}
+Editing SSL settings for an existing {{fleet-server}} might cause agents to lose connectivity. If you restrict `supported_protocols` or `cipher_suites` to values that connected {{agents}} don't support, those agents fail to check in. Verify that your chosen protocols and cipher suites are compatible with all connected {{agents}} before you apply the change.
+:::