Werk #20080: Rotate the agent-ca certificate with cmk-cert
| Component | Core & setup | ||
| Title | Rotate the agent-ca certificate with cmk-cert | ||
| Date | Aug 28, 2026 | ||
| Level | Trivial Change | ||
| Class | New Feature | ||
| Compatibility | Compatible - no manual interaction needed | ||
| Checkmk versions & editions |
|
cmk-cert can now rotate the Agent Signing CA keypairs, the CA that signs the certificates issued to registered agents.
The previous CA is not discarded, but kept alongside the new one and stays part of the trusted certificate store.
Registered agents therefore keep working. They migrate to the new CA when they renew their certificate, which happens automatically 45 days before it expires, with the default lifetime of 5 years.
The renewal can also be triggered manually on an agent by running cmk-agent-ctl renew-certificate, instead of waiting for the automatic one. In either case, no re-registration is needed.
Instead of generating a new CA, a custom one can be installed with --ca-pem.
Since the agent receiver authorizes agents by the common name of their certificate's issuer, it has to have the same common name as the current CA.
Rotating to a CA with a different common name requires --force and all agents to be registered again.
After the rotation, the agent receiver is reloaded so that both CAs are trusted.
The previous CA is kept as etc/ssl/agents/<date>_ca_old.pem. Once no agent uses a certificate issued by it anymore, deleting that file and running omd reload agent-receiver drops it from the trusted certificate store.