Automox Agent Code-Signing Certificate: Verifying the Thumbprint and Renewal Cadence (Windows)

Security and Zero Trust (ZTNA) posture checks often need to validate the Automox agent by its code-signing certificate. Because that certificate is rotated periodically, the most reliable approach is to read the current thumbprint and validity directly from a signed agent binary rather than relying on a fixed value. This article explains how the agent is signed, how to read the current certificate details yourself, and how to build an allow-list that will not break on renewal.

Applies to

• Windows devices running the Automox agent (amagent.exe).
• Administrators configuring application allow-listing, ZTNA posture checks, or EDR trust rules that key on the agent's code-signing certificate.

How the Windows agent is signed

Automox signs the Windows agent binary with Microsoft Authenticode, using a code-signing certificate issued to Automox, Inc. by a trusted public certificate authority. The signature includes a trusted timestamp.

Because of the timestamp, a binary that was signed while the certificate was valid continues to validate as trusted even after that certificate reaches its expiration date. If you inspect an older agent binary and see that its signing certificate has expired, that is expected and does not mean the agent is unsigned or untrusted.

Renewal and thumbprint rotation

Code-signing certificates are issued for a fixed term and must be renewed, so Automox rotates the certificate periodically. When a rotation occurs:

• Newly signed agent versions carry the new certificate, which has a new thumbprint.
• Previously signed binaries keep their original timestamped signature and continue to validate.

The practical consequence: any rule that pins a single certificate thumbprint will eventually need to be updated when Automox rotates the certificate. Plan for the thumbprint to change rather than treating it as permanent.

Read the current thumbprint and validity yourself

Because the value changes on rotation, read it from a current, signed agent binary on one of your own devices. This is always the authoritative, up-to-date source.

Using PowerShell:

(Get-AuthenticodeSignature "C:\Program Files (x86)\Automox\amagent.exe").SignerCertificate |
  Format-List Subject, Issuer, Thumbprint, NotBefore, NotAfter

This returns the Subject (Automox, Inc.), the issuing authority, the current Thumbprint, and the validity window (NotBefore and NotAfter).

Using the Windows GUI:

1. Right-click C:\Program Files (x86)\Automox\amagent.exe and choose Properties.
2. Open the Digital Signatures tab, select the signature, and click Details.
3. Click View Certificate, then the Details tab, and read the Thumbprint field. The General tab shows who the certificate was issued to, who issued it, and the valid-from and valid-to dates.

Recommended approach for allow-listing and posture checks

Where your tooling allows it, validate the agent on the stable publisher (Subject: Automox, Inc.) rather than on a single certificate thumbprint. Publisher-based rules survive certificate rotation, while thumbprint-pinned rules do not.

If your tool requires a specific thumbprint, read the current value using the steps above, and treat the thumbprint as something you will update whenever Automox rotates the certificate. Newly signed agent versions will reflect the new thumbprint on their next update. For the current certificate's thumbprint or validity window at a specific point in time, you can also contact Automox Support.