Trusted certificates for Agent-based Private probes

Add custom trusted certificates for your website or URI entities monitored by an Agent-based private probe that use a certificate issued by an internal certificate authority, an intermediate CA, or a self-signed certificate.

Prerequisites

To use the Trusted certificates feature on your Agent-based Private probe, you need the following.

• Agent-based Private probe version 2.2.0 installed on a supported Linux host.

• A user with permissions to edit the Agent-based Private probe configuration.

• The public certificate in PEM format, or the certificate chain that you want the probe to trust.

Add a custom trusted certificate

1. Click Digital Experience > Probe Locations > Private to open the Private probe list.

2. Add or edit a Private probe.

   1. Add: Click Add Private probe.

   2. Edit: Click the vertical ellipsis on the Private probe you want to edit, and then click Edit.

3. Continue to the Configuration step.

4. Click Add Certificate.

5. Enter a short descriptive name for the certificate such as Corporate Root CA or Staging Self-Signed.

6. Enter the certificate content in PEM format, including the certificate delimiters, or load a PEM file.

   1. Enter the certificate in PEM format.

      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----

   2. Click load certificate, and then select the certificate file you want to load.

      When you load a file, the file's contents are entered in the certificate content field. If the name field is empty, the name is populated from the file name without its extension.

7. Review any validation messages, and then click save to save your certificate.

8. Complete the Add or Edit Private probe wizard.

Review configured certificates

Expand a certificate entry in the Custom trusted certificates section to view the certificate details, including the following.

• Subject

• Issuer

• Valid from

• Valid to

You can edit or remove each certificate entry.

How are certificates validated?

SolarWinds Observability validates the certificate's contents while you enter or load it. Content may be accepted, accepted and reported with a warning or status indicator, or rejected.

Valid certificates do not display a warning. If an entry contains more than one certificate, its status reflects the most serious condition found in that entry.

Which content is rejected?

• Malformed or non-PEM content

• Content that does not contain a valid certificate

• Private key blocks, such as BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY, or BEGIN EC PRIVATE KEY

• Certificate content larger than 1 MB for a single entry

• A certificate with the same fingerprint as one already configured for the probe

Which content is reported with a warning or status indicator?

• The certificate is expired.

• The certificate is not yet valid.

• The certificate expires within 30 days.

How does the Agent-based Private probe use custom trusted certificates?

After the configuration is saved, the updated trusted certificate configuration is sent to the Agent-based Private probe. The Private probe combines the configured certificates with its built-in trust store and uses the resulting trust store for subsequent HTTP and HTTPS checks.

Configuration changes normally take effect within a few minutes. A full Agent reinstall is not required. Checks already in progress finish with their existing configuration; subsequent checks use the updated trust store. Certificate configuration is retained when the Agent-based Private probe is restarted or upgraded.

Edit or remove a trusted certificate

1. Click Digital Experience > Probe Locations > Private to open the Private probe list.

2. Click the vertical ellipsis on the Private probe you want to edit, and then click Edit.

3. Continue to the Configuration step.

4. Edit or remove the trusted certificate.

5. Expand the Custom trusted certificates (optional) section and click Edit. Update the name or replace the PEM content, then click Save.

6. Expand the Custom trusted certificates (optional) section and click Remove. Click Yes to confirm the removal.

Unsupported plugin versions

If the installed Private Probe does not support custom certificates, the certificate controls are disabled and the following message is displayed:

This version of the Private Probe plugin does not support custom certificates. Please update the version if you want to use this feature.

Troubleshoot trusted certificate check failures

If an Availability check (HTTP or HTTPS) fails with a certificate error, complete the following.

1. Open the Agent-based Private probe configuration.

2. Check that the correct internal CA, intermediate certificate, or self-signed certificate is configured.

3. Expand the certificate entry and review its Subject, Issuer, and validity dates.

4. If the certificate was rotated, add the new certificate before removing the old one.

5. Check the Private Probe plugin health in Settings > Agents > select the agent > Plugins.

6. Review the UAMS Agent or plugin logs for certificate parsing or trust-store errors. Certificate contents are not written to the logs.

7. If the plugin cannot apply the certificate configuration, its health status indicates a problem until the configuration is corrected.