Upload SSL certificates

Upload existing SSL certificates for securing communication between AgentX Server and AgentX Clients.

Prerequisites

• AgentX Server installed in Logpoint

• AgentX Manager installed in Logpoint

• Administrator access to Logpoint

• Existing SSL certificates (rootCA.pem, sslagent.cert, sslagent.key)

• In distributed Logpoint setups, you must upload certificates on the Search Head

Procedure

1. Go to Settings > Configuration and select AgentX.

2. Select Certificates.

3. Select Browse and locate your rootCA.pem file.

4. Select Upload.

5. In the confirmation dialog, select Yes to confirm certificate upload.

6. Replace existing certificates on all AgentX Clients with your sslagent.cert and sslagent.key files.

Expected outcome

AgentX uploads the rootCA.pem certificate to AgentX Server. You must manually distribute sslagent.cert and sslagent.key to all agents.

Existing agents continue using old certificates until you replace them.

Verification

1. Go to Settings > Configuration > AgentX > Certificates.

2. Verify that the upload completed successfully.

After replacing certificates on agents:

1. Go to Settings > Configuration > AgentX > Agents.

2. Verify that agents reconnect successfully and appear in the agents list.

Replace certificates on Windows agents

1. Navigate to the AgentX Client installation directory (default: C:\Program Files (x86)\ossec-agent\cert).

2. Back up the existing certificate files.

3. Copy your sslagent.cert and sslagent.key files to the cert directory.

4. Restart the AgentX Client service:

   • Open Services (services.msc)

   • Right-click the AgentX or OSSEC service

   • Select Restart

Replace certificates on Linux agents

1. Navigate to the certificate directory:

cd /opt/logpoint/ossec/cert

1. Back up the existing certificate files:

sudo cp sslagent.cert sslagent.cert.backup
sudo cp sslagent.key sslagent.key.backup

1. Copy your certificate files to the directory.

2. Set appropriate permissions:

sudo chown root:ossec sslagent.cert sslagent.key
sudo chmod 640 sslagent.cert sslagent.key

1. Restart the wazuh-agent service:

sudo systemctl restart wazuh-agent

Configuration guidelines

Use certificates from trusted Certificate Authorities For production environments, use certificates signed by trusted Certificate Authorities rather than self-signed certificates.

Upload certificates before agent deployment If you have existing organizational certificates, upload them before deploying AgentX Clients to avoid replacing certificates on all agents later.

In distributed mode, certificates sync automatically When operating in distributed mode, AgentX automatically syncs rootCA.pem to all Logpoint nodes in the cluster. You only need to upload certificates once on the Search Head.

Ensure certificate chain is complete If your certificates require intermediate CA certificates, ensure the complete chain is included in rootCA.pem.

Keep client certificates secure Store client certificates securely. Anyone with access to these certificates can authenticate agents to your AgentX Server.

Next steps

• Generate SSL certificates

• Install AgentX Client on Windows