OS Provisioning approval

When you boot a server into a service OS, a special version of the SA Agent is used to communicate with the SA Core. This OS Provisioning Agent needs to register with the Core before the server enters Maintenance mode. An OS Provisioning Agent always registers to the SA Core using the Bootstrap certificate, even when the SA Core runs in third-party certificate mode. This compensates for external CAs not being able to sign certificates for servers that do not have an Operating System installed yet.

The spin.agent.bootstrap_enabled controls whether an SA user has to approve OS Provisioning Agents request to register with the SA Core and enter Maintenance mode. For more information, see The spin.agent.bootstrap_enabled parameter.
When entering Maintenance mode, the OS Provisioning Agent receives a temporary self-signed Agent certificate, as described in Self-signed temporary SA Agent certificates.

Replacing temporary Agent certificates with third-party certificates

Servers provisioned using SA Provisioning use temporary Agent certificates even when SA runs in third-party certificate mode. Once provisioning is complete and your Certificate Authority can sign the SA Agent certificate, replace the temporary certificate with the final certificate issued by your CA. For more information, see Phase 2: Update your SA Agent certificate to use third-party certificate mode.