Werk #19542: Establish relay trust explicitly via the site certificate fingerprint
| Component | Relay | ||||
| Title | Establish relay trust explicitly via the site certificate fingerprint | ||||
| Date | Jul 14, 2026 | ||||
| Level | Prominent Change | ||||
| Class | New Feature | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
When a relay registers with a Checkmk site, it connects to the site's agent receiver over TLS. Until now the relay accepted whatever certificate the site presented during registration (trust on first use), with no way to confirm out of band that it was really talking to the intended site, leaving registration open to a man-in-the-middle.
Relay registration now supports establishing that trust explicitly.
cmk-relay register accepts a new --cert-fingerprint option that checks the
presented certificate against a known SHA-256 fingerprint and stops
registration if it does not match. The fingerprint is delivered through a
trusted channel: the relay setup in the Setup GUI computes it from the site
certificate and includes it in the generated Linux installation command, so
these installs pin the certificate automatically with nothing extra to
configure.
--cert-fingerprint is mutually exclusive with the existing --trust-cert
option, which keeps the previous "accept the presented certificate" behavior
for cases where a fingerprint cannot be used (for example, when a
TLS-terminating proxy in front of the site presents a different certificate).
The interactive confirmation prompt, which shows the certificate fingerprint
before accepting it, is unchanged.