Migrating root certificate to 3072-bit key

To improve security in the cryptographic systems, migrate the root certificates from a 2048-bit to a 3072-bit in ePO - On-prem.

Before you begin, make sure your system meets these requirements:

1. Navigate to Menu → Configuration → Certification Manager.

   The Key Size of root certificate displays 2048.

2. Click Regenerate Certificate and click OK to start the regeneration.

   The time needed to generate the new certificates varies depending on the number of Agent Handlers and Extensions that derive certificates from the ePO root CA.

   Note

   Before you move to next step, ensure that all targeted systems have communicated with ePO - On-prem. Otherwise, these systems may not receive the newly generated certificates, leading to communication issues with ePO - On-prem after migration.

3. Perform Wakeup Agent to ensure that the endpoint's status reaches 100% upon receiving the newly generated certificate.

4. In Certificate Manager, go to Product: Agent Handler → Status and check if the percentage of agents that have received the newly-generated certificates is 100%. If the status is not 100%, click the link and complete the processing.

5. Click Activate Certificate.

6. (Mandatory) Restart both ePO - On-prem and the Agent Handler services to apply the changes. For more information on best practices for migration, see KB87017.

7. Perform Wakeup Agent to ensure that the endpoint's status reaches 100% upon receiving the newly generated certificate.

8. Click Finish Migration.

   In case you want to cancel the migration, click Cancel Migration and then restart both Trellix ePO and the Agent Handler services.

9. (Mandatory) Restart both ePO - On-prem and the Agent Handler services to apply the changes. For more information on best practices for migration, see KB87017.