Linux Agent Showing Expired or Invalid Automox Certificates

Linux Agent Showing Expired or Invalid Automox Certificates

A Linux device that does not appear in the console, or that stops checking in, can be failing to establish a secure connection to the Automox API. Two different certificate errors cause this and they have different fixes, so start by identifying which one the agent is reporting.

Finding the error

Check the agent log on the device:

sudo tail -n 100 /var/log/amagent/amagent.log

If you would rather not work on the endpoint directly, see Retrieving Automox Agent logs. For agent file locations generally, see Location of Files Required By Automox.

Error: certificate has expired or is not yet valid

loop.go:289: ERROR: client.DoInstall(): Post "https://api.automox.com/install": x509:
certificate has expired or is not yet valid: current time xxxx-xx-xxTxx:xx:xx+xx:xx is
after xxxx-xx-xxTxx:xx:xx+xx:xxZ

The agent relies on the certificate authority data stored by the operating system. This error has two common causes.

Cause 1: stale CA data

Update the system CA bundle for your distribution, then restart the agent.

Red Hat based systems:

sudo yum update ca-certificates -y
sudo update-ca-trust

On newer releases that use dnf:

sudo dnf update ca-certificates -y
sudo update-ca-trust

Debian and Ubuntu:

sudo apt-get update
sudo apt-get install --only-upgrade ca-certificates
sudo update-ca-certificates

SUSE:

sudo zypper refresh
sudo zypper update ca-certificates
sudo update-ca-certificates

Then restart the agent:

sudo systemctl restart amagent
sudo systemctl status amagent

Cause 2: the system clock is wrong

Certificate validity is evaluated against the device's own clock, and the error message includes the current time the device believes it is. If that time is significantly wrong, a perfectly valid certificate is read as expired or not yet valid, and updating the CA bundle changes nothing.

Compare the time reported in the error against the actual time, and check the device:

timedatectl status
date

If the clock is off or time synchronization is not active, enable it and then restart the agent:

sudo timedatectl set-ntp true

This is worth checking first on virtual machines that have been suspended or restored from a snapshot, since their clocks commonly drift.

Error: certificate signed by unknown authority

x509: certificate signed by unknown authority

This is a different problem. The certificate is not expired, the device does not trust the authority that issued it. There are two common causes.

Cause 1: a required root certificate is missing

The agent uses the local system certificate store, and a missing root certificate prevents it from validating the Automox API. See Agent Error: x.509 Certificate Signed By Unknown Authority for the certificate involved and the install commands per operating system.

Cause 2: SSL inspection on the network

If traffic passes through an SSL inspection or TLS interception service, that service presents its own certificate in place of the original. The agent does not trust it, and the connection fails.

SSL inspection is not supported for Automox agent traffic and must be bypassed. This applies to all inspection providers. The agent authenticates to the Automox platform using mutual TLS, where both the client and the server present certificates. An inspection service replaces the agent's client certificate during the handshake, which breaks that authentication. Trusting the inspection service's certificate on the device does not resolve it, because the problem is the substitution of the client certificate rather than trust of the server certificate.

Add Automox agent traffic to the SSL inspection bypass list on your inspection or proxy platform. For the destinations to allow, see Platform Firewall Allowlisting Rules.

Confirming the fix

After making a change, restart the agent and watch the log for a successful connection rather than a repeat of the certificate error:

sudo systemctl restart amagent
sudo tail -f /var/log/amagent/amagent.log

The device should appear or resume checking in shortly afterwards. If the same error persists, see Checking and Starting the Automox Agent - Linux.

Related articles

Was this article helpful?
0 out of 0 found this helpful