Werk #20079: Audit the CAs trusted by the agent controller
| Component | Checks & agents | ||
| Title | Audit the CAs trusted by the agent controller | ||
| Date | Aug 10, 2026 | ||
| Level | Trivial Change | ||
| Class | New Feature | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
The ruleset Checkmk agent installation auditing has a new option Expected trusted CAs of the agent controller. It takes a list of SHA-256 certificate fingerprints, each of them combined with the site whose connection has to trust the CA - the agent controller trusts CAs per connection. The Check_MK service reports selected non-OK state if such a CA is not trusted. CAs the controller trusts but that are not listed are ignored, and hosts that have no connection with the configured site are not affected, so you can list the CAs of all your sites in a single rule.
Each entry can carry an optional Required from date. Until that date, a missing CA does not affect the service state, which allows to configure a new CA before it is rolled out to the hosts.
The service details list the CAs the controller reports per connection, the same information as in the output of cmk-agent-ctl status on the monitored host. Note that only agent controllers of this version or newer report their trusted CAs; on hosts running an older agent, all configured fingerprints are considered missing.