The spin.agent.bootstrap_enabled parameter

The spin.agent.bootstrap_enabled parameter in SA 10.60 and later controls whether SA Agents can use the self-signed Bootstrap certificate to register to an SA Core installed in third-party certificate mode.

You can set the value of this parameter from Administration > System Configuration > Configuration Parameters > Data Access Engine (spin) to one of the values below:

  Value Description
  0 (Default)

For SA Agents

Does not allow SA Agents to register using a Bootstrap certificate. Instead, install the SA Agents with third-party certificate directly.

For OS Provisioning Agents

Does not allow OS Provisioning Agents to register with the SA Core automatically. Instead, the servers receive a temporary SA Agent certificate and enter Maintenance Mode only after an SA user approves their registration request from the SA Client. If the server registration is rejected, the registration fails and the server does not enter Maintenance Mode.
This ensures that unauthorized servers cannot register with an SA Core.

  1

For SA Agents

Allows SA Agents to register with the SA Core using the Bootstrap certificate.

Make sure your company regulation allows using temporary SA self-signed certificates.

For OS Provisioning Agents

OS Provisioning Agents register to the SA Core automatically, without going through the extra approval process.

Validity of the self-signed temporary agent certificates

The temporary Agent certificate signed by SA is not valid for ten years as it normally is in self-signed certificate mode. You can set the validity of this temporary Agent certificate during SA installation time or during Core recertification.
For example, if your company policy states that a managed server should receive its final certificate from your CA within seven days from the installation, you can set the validity of the temporary Agent certificate to seven days. If the temporary certificate is not replaced with a final certificate from your CA within this timeframe, the SA Agent is no longer be able to communicate with the SA Core.

Related topics