Skip to main content

Agent TLS configuration

By default, the agent connects to the Trust Domain Server over TLS and applies standard WebPKI validation. The server certificate must chain to a trusted root and must present a DNS name (SAN) that matches the endpoint the agent connects to. The agent verifies the certificate against the system CA certificates bundled in its container image. No extra configuration is needed on the agent when the server certificate is signed by a public CA (for example, an ACM certificate on an AWS load balancer, or Let's Encrypt).

Trusting a private CA​

If you run an internal CA for TLS and have issued the certificate on your load balancer or Trust Domain Server from that CA, the agent will not trust it by default, because the internal root is not among the bundled CA certificates. Supply the internal CA certificate so the agent trusts certificates issued by your CA.

Supplemental roots add extra root CAs on top of the bundled CA certificates. Set them only when the certificate presented at the endpoint the agent connects to is signed by a private CA not present in the bundled CA certificates. The endpoint is whatever terminates TLS for the agent connection. In the most common deployment, that is a load balancer in front of the Trust Domain Server, so the relevant certificate is the one on the load balancer, not on the server itself. See TLS on the agent API listener for how to enable TLS on the server.

Supply the internal CA certificate as an inline PEM string under agent.endpoint.supplementalRootsPEM in your Helm values:

agent:
  endpoint:
    endpoint: "td-server.spirl.example.com"
    supplementalRootsPEM: |
      -----BEGIN CERTIFICATE-----
      <base64-encoded CA cert>
      -----END CERTIFICATE-----

Disable TLS (optional)​

To disable TLS (for example, in lab environments):

Set the SPIRL_ENDPOINT_ENABLE_TLS environment variable in your values file:

agent:
  env:
    - name: SPIRL_ENDPOINT_ENABLE_TLS
      value: "false"