Replace the Management Certificate

This page applies to the Management ISO. For Docker, Compose or Podman, use the container TLS settings and your host’s certificate-management process.

Use the Management VM console to replace its HTTPS certificate or change its TLS mode. For initial identity and certificate selection, see Initialize Management.

This procedure changes the Management endpoint certificate. It does not change the appliance gateway certificate or ERS certificate authorities.

Before you begin

Have access to the Management VM console and, for a supplied certificate, authenticated root SSH access. Prepare a certificate for the configured Management hostname, its matching unencrypted private key, and the required certificate chain.

Finish active operations and retain required downloads before changing TLS settings. Replacing a supplied certificate restarts the ingress proxy. Switching between ACME and an external certificate mode, or changing ACME account settings, restarts the Management container. After a Management restart, reconnect the appliance.

Install a supplied Certificate

  1. Verify the Management host’s SSH fingerprint through a trusted channel and connect as root.

  2. Create the staging directory:

    install -d -m 0700 /run/mtg-management-tls

  3. Transfer the certificate as /run/mtg-management-tls/tls.crt and its matching key as /run/mtg-management-tls/tls.key over authenticated SSH. Keep both files root-owned and the private key mode 0600.

  4. In the running Management console, select Manage Certificates and choose supplied-certificate mode.

  5. Follow validation and installation. The installer checks the pair and configured hostname. After successful installation, the staged files are removed.

  6. Open Management using its configured DNS name and inspect the served certificate, chain, hostname and expiry. Confirm that sign-in works.

Keep private keys out of configuration media, repositories, command arguments and logs. If validation fails, correct the staged pair and retry. Do not disable certificate verification to work around an incorrect hostname or chain.

Use ACME

In Manage Certificates, select ACME and enter the CA’s HTTPS directory URL and account email. The configured Management DNS name must resolve correctly, and the CA must reach inbound port 80 for the HTTP-01 challenge.

Management’s ingress proxy performs issuance and renewal. Check the actual served certificate after the change; a healthy Management status does not prove that issuance completed. The host does not automatically fall back to a self-signed certificate if ACME fails.

Maintain self-signed Certificates

Self-signed mode creates a persistent hostname certificate. Compare its fingerprint with the console when establishing browser trust. The host does not renew it or warn about expiry. Track its expiry and replace it through Manage Certificates before it becomes unusable.

For persistent TLS or startup failures, record the selected mode and error without exposing private keys, then follow diagnostics collection.