The reissue flow is initiated from the agent using the setup command line argument. When an agent that is already registered uses the setup command line argument setup and fills in the required credentials, a new registerAgent command is sent to the server.

The server detects that the agent is already registered and sends the agent a new client certificate without creating another agent resource. On the agent side, the new client certificate replaces the old one. In cases where the server certificate is modified and you run the setup command, you see a message that asks you to trust the new certificate. You can alternatively provide the new server certificate thumbprint in the file before running the setup command, to make the process silent.


Manage agent privilege to revoke and update certificates.


  • On Linux based operating systems, run the setup command on the agent host. On Windows based operating systems, run the ep-agent.bat setup command.
    If the agent detects that the server certificate has been modified, a message is displayed. Accept the new certificate if you trust it and it is valid.