Linux Agent Showing Expired or Invalid Automox Certificates
A Linux device that does not appear in the console, or that stops checking in, can be failing to establish a secure connection to the Automox API. Two different certificate errors cause this and they have different fixes, so start by identifying which one the agent is reporting.
Finding the error
Check the agent log on the device:
sudo tail -n 100 /var/log/amagent/amagent.log
If you would rather not work on the endpoint directly, see Retrieving Automox Agent logs. For agent file locations generally, see Location of Files Required By Automox.
Error: certificate has expired or is not yet valid
loop.go:289: ERROR: client.DoInstall(): Post "https://api.automox.com/install": x509: certificate has expired or is not yet valid: current time xxxx-xx-xxTxx:xx:xx+xx:xx is after xxxx-xx-xxTxx:xx:xx+xx:xxZ
The agent relies on the certificate authority data stored by the operating system. This error has two common causes.
Cause 1: stale CA data
Update the system CA bundle for your distribution, then restart the agent.
Red Hat based systems:
sudo yum update ca-certificates -y sudo update-ca-trust
On newer releases that use dnf:
sudo dnf update ca-certificates -y sudo update-ca-trust
Debian and Ubuntu:
sudo apt-get update sudo apt-get install --only-upgrade ca-certificates sudo update-ca-certificates
SUSE:
sudo zypper refresh sudo zypper update ca-certificates sudo update-ca-certificates
Then restart the agent:
sudo systemctl restart amagent sudo systemctl status amagent
Cause 2: the system clock is wrong
Certificate validity is evaluated against the device's own clock, and the error message includes the current time the device believes it is. If that time is significantly wrong, a perfectly valid certificate is read as expired or not yet valid, and updating the CA bundle changes nothing.
Compare the time reported in the error against the actual time, and check the device:
timedatectl status date
If the clock is off or time synchronization is not active, enable it and then restart the agent:
sudo timedatectl set-ntp true
This is worth checking first on virtual machines that have been suspended or restored from a snapshot, since their clocks commonly drift.
Error: certificate signed by unknown authority
x509: certificate signed by unknown authority
This is a different problem. The certificate is not expired, the device does not trust the authority that issued it. There are two common causes.
Cause 1: a required root certificate is missing
The agent uses the local system certificate store, and a missing root certificate prevents it from validating the Automox API. See Agent Error: x.509 Certificate Signed By Unknown Authority for the certificate involved and the install commands per operating system.
Cause 2: SSL inspection on the network
If traffic passes through an SSL inspection or TLS interception service, that service presents its own certificate in place of the original. The agent does not trust it, and the connection fails.
SSL inspection is not supported for Automox agent traffic and must be bypassed. This applies to all inspection providers. The agent authenticates to the Automox platform using mutual TLS, where both the client and the server present certificates. An inspection service replaces the agent's client certificate during the handshake, which breaks that authentication. Trusting the inspection service's certificate on the device does not resolve it, because the problem is the substitution of the client certificate rather than trust of the server certificate.
Add Automox agent traffic to the SSL inspection bypass list on your inspection or proxy platform. For the destinations to allow, see Platform Firewall Allowlisting Rules.
Confirming the fix
After making a change, restart the agent and watch the log for a successful connection rather than a repeat of the certificate error:
sudo systemctl restart amagent sudo tail -f /var/log/amagent/amagent.log
The device should appear or resume checking in shortly afterwards. If the same error persists, see Checking and Starting the Automox Agent - Linux.