Manage the TLS certificate that nginx uses for HTTPS (port 5001). Agents validate this certificate using Windows trusted roots or thumbprint pinning (ServerCertThumbprint in appsettings.json).
{{ cert.subject_cn }}
{{ cert.san_list.join(', ') }}
{{ formatDate(cert.not_before) }}
{{ formatDate(cert.not_after) }} ({{ cert.expires_in_days }} days remaining) (EXPIRED {{ Math.abs(cert.expires_in_days) }} days ago)
{{ cert.thumbprint }}
Use this value for ServerCertThumbprint in agent appsettings.json to enable certificate pinning (prevents MITM attacks).
{{ cert.issuer }}
Self-signedNo certificate file found at certs/server.crt
Create a new self-signed certificate for development or air-gapped sites. The certificate will be valid for 1 year (365 days).
Hostname or IP that agents use to connect (e.g., shopdb.example.com or 192.168.100.1)
Comma-separated list: DNS:hostname or IP:address (e.g., DNS:localhost,IP:192.168.100.1,DNS:shopdb.local)
Certificate lifetime (recommended: 365 for self-signed)
Upload a certificate from a trusted CA or internal PKI. You must provide both the certificate (.crt or .pem) and private key (.key).
PEM-encoded certificate (.crt or .pem)
PEM-encoded private key (.key or .pem, unencrypted)
To prevent MITM attacks with self-signed certificates, configure agents to validate the server certificate thumbprint:
{
"ServerCertThumbprint": "AA:BB:CC:..."
}
Important: When you renew the server certificate, you must update ServerCertThumbprint on all agents before the old certificate expires, or agents will reject connections.
For air-gapped sites, generate the certificate on the work PC and include it in the deployment bundle: