Certificate authority certificates for the multi-platform probe


You may need to add a custom TLS certificate to your Linux system when you use custom Certificate Authority (CA) certificates, self-signed certificates, or corporate Public Key Infrastructure (PKI) in your PRTG environment. This ensures that your multi-platform probe can establish secure connections with the PRTG core server.

There are several methods to transfer files from Windows to Linux systems, including SCP, SFTP, and manual copy-paste operations. This article focuses on the manual copy method, which works across all environments without requiring additional tools or network connectivity between systems.

You can install the certificate in two locations:

  • Linux system trust store: Use this method when you want the certificate to be trusted system-wide by all applications on the Linux machine.
  • /etc/paessler/mpprobe/certs directory: Use this method when you want to limit the certificate trust to PRTG only, keeping it isolated from other system applications.

Prerequisites

Before you begin, ensure that you meet the following requirements:

  • PRTG version 26.1.118 or later
  • Administrative access on both the Windows system (running PRTG core server) and the Linux system (running the multi-platform probe)
  • The certificate must be in PEM format with one of the following file extensions: .pem, .crt, .cer, or .key

Step 1: Export the CA Certificate from PRTG

  1. On your Windows system, open the PRTG Administration Tool.
  2. Navigate to the NATS Server tab.
  3. Click Copy CA certificate to clipboard.

The CA certificate is now copied to your clipboard in PEM format.

Step 2: Copy the Certificate to Your Linux System

For Debian/Ubuntu Systems

  1. On your Windows system, open a text editor (such as Notepad).
  2. Paste the certificate content from your clipboard (Ctrl+V).
  3. Save the file with a .crt extension (for example, prtg-ca.crt).
  4. Transfer the file to your Linux system using your preferred method (USB drive, network share, or remote desktop).
  5. On your Linux system, save the certificate file to a temporary location such as /tmp or your home directory.

For RHEL Systems

  1. On your Windows system, open a text editor (such as Notepad).
  2. Paste the certificate content from your clipboard (Ctrl+V).
  3. Save the file with a .crt extension (for example, prtg-ca.crt).
  4. Transfer the file to your Linux system using your preferred method (USB drive, network share, or remote desktop).
  5. On your Linux system, save the certificate file to a temporary location such as /tmp or your home directory.

Step 3: Choose Your Installation Method

Option A: Add to Linux System Trust Store

Use this method when you want the certificate to be trusted by all applications on your Linux system, not just PRTG.

For Debian/Ubuntu Systems

  1. Copy the certificate to the CA certificates directory:
    sudo cp /tmp/prtg-ca.crt /usr/local/share/ca-certificates/
  2. Update the system trust store:
    sudo update-ca-certificates
  3. Verify the installation:
    ls -l /usr/local/share/ca-certificates/prtg-ca.crt

    You should see the certificate file listed with appropriate permissions.

For RHEL Systems

  1. Copy the certificate to the CA trust directory:
    sudo cp /tmp/prtg-ca.crt /etc/pki/ca-trust/source/anchors/
  2. Update the system trust store:
    sudo update-ca-trust
  3. Verify the installation:
    ls -l /etc/pki/ca-trust/source/anchors/prtg-ca.crt

    You should see the certificate file listed with appropriate permissions.

Option B: Add to PRTG Probe Certificate Directory

Use this method when you want to limit certificate trust to PRTG only, keeping it isolated from other applications on your Linux system.

  1. Copy the certificate to the PRTG probe certificate directory:
    sudo cp /tmp/prtg-ca.crt /etc/paessler/mpprobe/certs/
  2. Set the appropriate permissions:
    sudo chmod 644 /etc/paessler/mpprobe/certs/prtg-ca.crt
sudo chown root:root /etc/paessler/mpprobe/certs/prtg-ca.crt
  3. Restart the probe service:
    sudo systemctl restart prtgprobe
  4. Verify the installation:
    ls -l /etc/paessler/mpprobe/certs/prtg-ca.crt

    You should see the certificate file with permissions set to 644 and owned by root.

Verification

After you install the certificate using either method, verify that the probe can connect to the PRTG core server:

  1. Check the probe status in the PRTG web interface.
  2. Navigate to Setup > System Administration > Core & Probes.
  3. Verify that your multi-platform probe shows a status of Connected.

If the probe does not connect, check the probe logs for certificate-related errors:

sudo journalctl -u prtgprobe -n 50