Skip to content

Linux Agent - install and setup

CertIntel also publishes a Linux build of the Agent: a static service/CLI binary for amd64 and arm64. It covers the same certificate lifecycle work as the Windows Agent - TLS monitoring, filesystem certificate monitoring, and ACME workflows with the embedded client - minus the pieces that only make sense on Windows (the desktop app, Windows certificate stores, IIS/Windows service integration).

Requirements

  • A systemd-based Linux distribution, x86_64/amd64 or aarch64/arm64.
  • Root access for installation (the installer detects and, with your confirmation, installs missing dependencies via apt, dnf, yum, or zypper).
  • Outbound HTTPS to your CertIntel API and the selected ACME certificate authority.

The service runs as a dedicated, unprivileged certintel-agent user under a hardened systemd unit. Default locations:

Item Path
CLI/service binary /usr/bin/certintel-agent
systemd unit /etc/systemd/system/certintel-agent.service
private state (config, credentials, ACME state, certificates) /var/lib/certintel-agent
runtime socket directory /run/certintel-agent

Install

Set a one-time cit_ install token from Install Tokens and run the bootstrap script as root:

sudo env CI_INSTALL_TOKEN="cit_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
bash -c 'curl -fsSL https://assets.certin.tel/downloads/agent/latest/install-linux.sh | bash'

If you're running a self-hosted CertIntel, add CI_API_BASE:

sudo env CI_INSTALL_TOKEN="cit_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" CI_API_BASE="https://your-certintel-server.example" \
bash -c 'curl -fsSL https://assets.certin.tel/downloads/agent/latest/install-linux.sh | bash'

The installer checks the release manifest against CertIntel's independently published release record, downloads the binary matching your architecture, verifies its SHA-256 and embedded version, installs the systemd service, and enrolls the device - all without further prompting. To connect with an existing API key instead of an install token, use CI_API_KEY="cik_..." in place of CI_INSTALL_TOKEN. Run interactively with no environment credential and it prompts for one without echoing it to the terminal.

An upgrade (re-running the installer on a connected host) replaces only the binary and systemd unit; configuration, credentials, ACME state and certificates in /var/lib/certintel-agent are untouched.

After installation

sudo certintel-agent status --json
sudo certintel-agent diagnostics

Use register instead of enroll if you're scripting a connection with an existing agent API key rather than an install token, and --stdin to pass a secret without it ever appearing as a command-line argument or in shell history.

If your organization requires agent approval, reporting stays rejected until an administrator approves the new device on the CertIntel Agents page - see Install tokens & enrollment.

What's different from Windows

Linux does not run the WPF desktop app or the Windows-specific deployment helpers - no IIS integration, no Windows certificate stores, no Windows service restart action. Everything else is supported: TLS endpoint monitoring, filesystem certificate monitoring, ACME workflows and certificate installation to files, and the local CLI.

Next steps