Press CTRL+K to open search

Update ePO certificates

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

The EDR Telemetry Store uses a trusted mTLS connection with the ePO - On-prem server and the DXL Broker. If your environment uses custom certificates or migrates to CA-Signed 3K certificates, you must update the EDR Telemetry Store trust store to maintain trace data ingestion.

To update both custom and 3K certificates, perform the following steps:

  1. Log in to the EDR Telemetry Store via SSH as an administrator.

    ssh admin@<IP_address>

  2. Run these commands to start the Cluster Setup Wizard:

    enable
[sudo] password for admin:
configure
opensearch cluster setup

  3. In the Configuration Menu, type 2 to select Certificate Configuration and press Enter.

  4. In the SSL/TLS Certificate Configuration menu, type 3 to select Update ePO certificates and press Enter.

    The wizard redirects you to the main Configuration Menu.

  5. Type 5 to select Review & Generate Configuration and press Enter.

  6. In the DNS Validation page, press Enter when the DNS entries are ready for validation and type y to continue.

  7. In the Configuration Summary and Confirmation page, type y to confirm the settings.

  8. Enter the ePO server username and password to retrieve the CA certificates.

    Note

    The EDR Telemetry Store executes a remote command to download the root certificate directly from the ePO - On-prem server:

    curl -k -s -u "<username>:<password>" "https://<ePO_IP>:<ConsolePort>/remote/epo.command.createAgentHandlerCertificateAuthority"

    The system retrieves the certificate and generates the updated configuration file.

  9. Run the following command to deploy the updated certificate changes to the cluster:

    opensearch cluster deploy

Verify the certificate update

Once the deployment completes, use the system shell to confirm that the certificates are collected.

  1. Run the following commands to access the system shell:

    enable
[sudo] password for admin:
shell

  2. At the shell prompt, run the following commands to locate the directory and view the latest log file:

    cd /var/log/trellix/opensearch/
ls
cat <latest_logfile_name>.log

    Verify the following:

    • The system establishes a successful connection to the ePO server.

    • The log displays the retrieved 3K certificate.

    • Confirm the log shows a successful connection to the ePO server and the retrieved 3K certificate.

  3. At the shell prompt, run the following commands to verify the saved certificate files in the certificate directory:

    cd /etc/opensearch/certs
ls
cat epo-ca-0.pem
cat ca.pem

    • epo-ca-0.pem — Displays the new 3K certificate.

    • ca.pem — Displays both 2K and 3K certificate blocks.

This adds the 3K certificate to the appliance for secure mTLS communication and maintains the 2K trust chain.

Related articles