Werk #20086: Trusting a remote site's CA had no lasting effect with site-specific settings
| Component | Setup | ||||
| Title | Trusting a remote site's CA had no lasting effect with site-specific settings | ||||
| Date | Aug 26, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Bug Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
This werk affects you if your central site overrides the global setting "Trusted certificate authorities for SSL" with a site-specific value.
On the page "Distributed monitoring > SITE > Livestatus encryption" you can add a remote site's CA to the trusted certificate authorities using the thumb-up button. This action always wrote the certificate to the global setting, which the site-specific value replaces as a whole. The page reported the certificate as trusted right away, but the next "Activate changes" silently dropped it and encrypted Livestatus connections to that remote site started failing to verify again.
The thumb-up button now adds the certificate to the site-specific setting if the site-specific setting is already configured for the site, and to the global setting otherwise.
Note that if you later reset the central site's site-specific setting, the global setting applies again. It does not contain the certificates added while the site-specific setting was in place, so you have to trust these remote sites again.