Security Compliance
Root CA certificate generation checkbox in ARM Version 2025.2.1
This article addresses questions regarding the Root CA certificate generated during the upgrade to ARM version 2025.2.1.
First published date
Last published date
Overview
Whether an existing Root CA in the environment can be used instead of the Root CA generated by ARM, the recommended approach for certificate configuration, and how client certificates should be handled after the upgrade.
A new Generate Root CA Certificate checkbox is now available during the repair and upgrade process. It allows users to regenerate their certificates and automatically push them to the collector using the auto-push option.
The regeneration during repair or upgrade works as follows:
Existing certificates are removed.
New certificates are generated with updated expiry.
Client certificates are automatically distributed to all registered collectors.
Remote rich clients require manual upgrade and re-registration.
Product section
Resolution
During the upgrade to ARM version 2025.2.1, the installer provides an option to regenerate the existing Root CA and client certificates.
-
If the option is selected: The installer replaces the existing Root CA and client certificates with newly generated certificates with a new expiration date. The new certificate is also pushed to the ARM collectors; however, it is not automatically pushed to remote clients.
-
If the option is left unchecked: The existing Root CA and client certificates remain unchanged, and no certificate replacement occurs.
Recommendation: If there is no requirement to replace or renew the existing certificates, leave the option unchecked to retain the current certificate configuration.