Certificates
A Nexus Telemetry Fleet server identifies each collector by a certificate. The certificates form a chain of 3: the collector’s device certificate, signed by the organisation’s CA certificate, signed by the organisation’s root key. A fourth thing, the signing cover, is what lets the fleet server run without the root key. This page says what each is. The Certificates page on the dashboard shows all 4.
Device certificate
Each collector has one device certificate. The fleet server signs it when the collector enrols, and the collector presents it on every connection after that. The certificate is how the fleet server knows which collector is connecting. The enrolment token is used for that first enrolment only.
A device certificate lasts 1 year and renews without any action by a user.
CA certificate
The CA certificate signs every device certificate, and every renewal of one. It is itself signed by the root key, and it has an expiry of its own.
The fleet server keeps a series of CA certificates that the root key has already signed. When one nears the end of its window, the next takes over, with no action by a user.
Root key
The root key signs CA certificates and the fleet’s revocation list, and nothing else. It never connects to a collector, and no collector ever has it. A collector has the root certificate, the public half of the root key. The root certificate is the one part of the chain that does not change, so the CA certificate and the device certificate can both be replaced without touching the collector.
Signing cover
Signing cover is how far into the future the CA certificates have been signed. It is measured in years and shown on the dashboard. While there is cover, the fleet server enrols new collectors and renews existing ones without the root key. The root key can therefore be kept off the fleet server, and is then out of reach of anyone who compromises the fleet server. When the cover runs out, the fleet server can no longer enrol or renew until the root key is brought back to sign more. See Root key.
Renewal
A device certificate is renewed from 30 days before it expires. The fleet server checks for certificates due for renewal every 30 seconds.
Renewal runs over the connection the collector already has open. The collector generates a new private key, which never leaves its host. The fleet server signs the matching certificate and returns it over the same connection. The terminal stays online and its readings continue. The renewal is recorded in the Certificate Audit Log on the Certificates page, as Renewal started and Renewed.
The fleet server has a certificate of its own, which collectors check when they connect. It renews inside the same 30-day window, issued by the fleet server itself.
Long absence
A collector that has been switched off for months is trusted when it reconnects, because it trusts the root certificate and the root certificate has not changed. How many CA certificates were replaced meanwhile does not matter. A collector’s identity is separate from its certificates, so a collector that enrols again attaches to its original record, with the same name and history.
Expired collector
A collector that is offline when its device certificate expires cannot renew, because renewal requires a connection. It is restored with Re-admit this collector on the Admin view of its terminal’s page in the dashboard, and returns with its identity and history. See Retire and revoke.
Root key custody
The root key is the one part of this that a user manages: back it up, take it off the fleet server, and bring it back when the signing cover has to be extended. See Best practice for each step.