Control-plane and agent certificates
Rotate edge certificates and internal trust without replacing installation identity.
Infra uses separate certificate paths for the public edge, node identity, and external dependency trust. Rotating one path does not automatically rotate the others.
Public edge certificate
The console and API origin must serve a certificate trusted by operators, CLI clients, agents, and integrations that connect through that origin. Rotate its certificate at the proxy or ingress, then verify the chain and hostname from each required network path.
An edge certificate change does not change the installation identity. Keep the public URL stable unless a separate origin migration is intended. Changing both hostname and trust at once can make it harder to distinguish DNS, routing, and certificate failures.
Node identity
Enrollment issues a node identity bound to the organization and registered node ID. The agent stores its private identity material locally. Renewal uses the established authenticated path; it does not require a reusable enrollment token.
Nodes show current certificate expiry and renewal state in Fleet → Agents. An offline node can miss its renewal window and return with an expired identity. In Fleet → Agents, select that node and open Identity → Recover identity. Follow its ownership and host-identity checks before issuing replacement material. Confirm the same node ID reconnects and reports a fresh heartbeat. If identity checks fail, retain the node's cordon and correct the reported evidence or trust problem rather than weakening trust for every node in the region.
Rotate an internal issuer
Open Installation settings → Security → Node identities → Issuers and select Rotate issuer. Review the target nodes and control-plane replicas. Publish the new issuer trust before issuing identities that require it. Verify trust adoption on control-plane replicas and eligible nodes. Keep the old issuer trusted until required identities have renewed or been explicitly retired.
The rotation operation records adoption and outstanding identities. Removing an old issuer while an offline node still needs it can prevent that node from reconnecting normally. Plan for those nodes explicitly instead of treating a partial rollout as complete.
Dependency trust
PostgreSQL, object storage, identity providers, and external key services have their own trust chains. Update the configured bundle for the relevant consumer. A working browser certificate does not prove that a backup worker trusts its object-storage endpoint.
Unknown issuers and hostname mismatches reject the connection. Do not substitute an insecure verification flag as the permanent configuration. Correct the chain, hostname, or approved trust bundle.
Recovery material
Back up the installation identity and required issuer configuration according to control-plane backup. Protect private signing material separately from ordinary diagnostic exports.
Audit issuer changes, edge origin changes, identity recovery, and revocation. See enrollment for first registration and Connector delegation for hosted authorization, which is independent of node TLS identity.