SA Agent certificates

SA generates a Certificate Signing Request (CSR) file for each SA Agent installation. Submit this CSR to your external CA for signing, and provide the issued certificate before SA can resume the Agent installation.

The CSR and its private key are generated by an Agent script on the Agent machine. The private key is never transferred elsewhere. Make sure that the Agent certificate is signed by the same CA chain installed on the SA Core. This is because the SA Core and the SA Agents have to share the same trusted CAs. For more information, see SA certificates format.

Renew an SA Agent certificate

You can renew the certificate of an Agent through the Recertify Agent Program Extension. This extension enables you to replace the existing SA Agent certificate with a new one, while keeping the trusted CA chain. To change the CA chain, run a Core Recertification job. This recertifies both the SA Core and the Agents and enables you to change the CA chain.

To renew an SA Agent certificate, follow the steps below. The Recertify Agent Program Extension automates step 1, 4 and 5.

  1. Run the SA Agent script that generates the CSR.
  2. Submit the CSR to your CA for signing.
  3. Download the new certificate to a location of your choice on the SA Agent machine.
  4. Run the SA Agent script to remove the old certificate and install the new one.
  5. Restart the SA Agent.

Install an SA Agent without an external CA certificate

If you cannot provide a certificate from your CA when installing the SA Agent, see Self-signed temporary SA Agent certificates.

Related topics

Install an SA Agent in third-party mode using the CLI

Install the SA Agent in third-party mode using ADT