Regenerate WhatsUp Gold Agent Certificates and Restore Agent Connections

After upgrading WhatsUp Gold, newly deployed agents may install successfully but fail to connect, while agents deployed before the upgrade continue operating normally. This article explains how to regenerate the agent certificates, redeploy affected agents, and verify that agent communication has been restored.

Oct 22, 2026
Knowledge

Title

URL Name

000307375

Article Number

000307375

Environment

WhatsUp Gold 2026.0.0 and later, including versions 26.0.1 and 26.0.2 WhatsUp Gold servers upgraded from an earlier release Environments still using agent certificates generated before the server upgrade

Question/Problem Description

Agents deployed from 26.0.1 and 26.0.2 (agent 26.0.2.4235, go1.25.0) install with 0 errors and start.

They then log platform/pfmConnection.go:41 failed to add server CA's certificate and “Connection exited with code Faulted” every 120 s and never connect to the server on 9749.

Older agents (2023/2024 builds) using the identical AgentCertAuth.crt connect normally. The CA is CN=WugAgent.local, serial #, valid 2023-05-17 to 2043-05-12. Its Subject Key Identifier extension is marked critical, which RFC 5280 4.2.1.2 forbids and Go’s crypto/x509 rejects.

How do we regenerate the agent CA and server certificate on an existing install, and what is the impact on deployed agents?

Steps to Reproduce

Clarifying Information

Important: Regenerating the agent certificates replaces the trust relationship used by all deployed agents. Saving the new certificate settings initiates redeployment for all configured agents. Schedule a maintenance window before completing this procedure.

After upgrading the WhatsUp Gold server, newly deployed agents install and start successfully but never establish a connection with the WhatsUp Gold server. Agents deployed before the upgrade may continue reporting normally.

One or more of the following symptoms may occur:

The WhatsUp Gold Agent installs without an error.
The WhatsUp Gold Agent service starts successfully.
The newly installed agent never connects to the WhatsUp Gold server.
The agent log repeatedly reports:

failed to add server CA's certificate
The agent log repeatedly reports:

Connection exited with code Faulted
Previously deployed agents continue reporting normally.
Newly deployed agents consistently fail to connect.

Error Message

Defect Number

Enhancement Number

Cause

Upgrading the WhatsUp Gold server does not automatically replace the existing agent certificate set. Retaining the existing certificates prevents connected agents from being disconnected during the upgrade.

If the certificate authority files were generated by an older WhatsUp Gold release, newer agents may reject those certificates and fail to connect. Regenerating the certificates on the upgraded server creates a certificate set that current agent builds can use.

The certificate-generation issue was corrected in WhatsUp Gold 2026.0.0. However, upgraded installations retain their existing certificate set until an administrator regenerates the certificates and saves the updated Agent General Settings.

Resolution

Prerequisites:

Before regenerating the certificates:

Confirm that the WhatsUp Gold server is running version 2026.0.0 or later.
Schedule a maintenance window because the change affects all configured agents.
Identify devices that are offline or require manual agent installation.
Confirm that agents can reach the configured agent communication port. The default port is TCP 9749.
Confirm that you have permission to manage WhatsUp Gold agent settings.
Confirm that the credentials and network access required to redeploy agents are available.

1. Back Up the Existing Certificate Files

Back up the certificate and key files located in:

<WUG installation directory>\Data\ssl

The backup contains private keys and must be stored securely.

Do not:

Send private keys or agent deployment packages over unsecured channels.
Mix files from the existing and regenerated certificate sets if a restoration becomes necessary.

2. Open Agent General Settings

In the WhatsUp Gold console, go to:

Settings > WhatsUp Agent > Agent General Settings

3. Regenerate the Agent Certificates

Use the certificate-regeneration option to generate a new certificate set.

Before saving:

Confirm that the WhatsUp Gold server hostname is correct.
Use the server’s resolvable hostname.
Do not use an IP address in place of the server hostname.

4. Save the Agent Settings

Click Save to commit the regenerated certificates.

Saving the settings initiates redeployment for all configured agents.

5. Monitor Automatic Agent Redeployment

Monitor the Agent Library for deployment progress.

Automatic redeployment may require:

Administrative credentials for the managed systems
Network connectivity between the WhatsUp Gold server and the managed systems
Access to the configured agent communication port

If an agent does not update automatically, redeploy it manually.

6. Redeploy Manually Installed Agents

For devices that require manual deployment:

Regenerate the certificates.
Click Save in Agent General Settings.
Download a new manual deployment package.
Use the package only for the device for which it was generated.
Extract the entire ZIP file.
Run the setup program from the extracted directory.

Do not:

Generate the package before saving the new certificates.
Run the setup program from inside the ZIP file.
Reuse deployment packages created before certificate regeneration.

Verification

Confirm the following after redeployment:

The repeated CA certificate error no longer appears in the agent log.
Agents that worked before the change reconnect successfully.
Newly deployed agents connect successfully.
New Windows events from the affected devices appear in Log Management with current timestamps.
Every configured agent is accounted for.
Offline devices and devices requiring manual deployment are identified for follow-up.

Troubleshooting

If the issue continues:

Confirm that certificate regeneration was performed on WhatsUp Gold 2026.0.0 or later.
Confirm that Save was clicked after the certificates were regenerated.
Confirm that manual deployment packages were generated after the certificate change.
Do not repeatedly rotate the certificate set for the entire agent fleet if the same CA certificate error continues.
If the agent reports a healthy status but events are missing:
- Review the agent-based collection settings.
- Confirm that the affected device can reach Elasticsearch.

Information to Provide to Progress Technical Support

If additional assistance is required, provide:

WhatsUp Gold server version
Agent version
Exact error messages
Timestamps associated with the errors
Whether the agent was deployed automatically or manually

Do not provide passwords or private keys.

Preventive Guidance

After upgrading to WhatsUp Gold 2026.0.x or later, schedule a certificate-rotation maintenance window before deploying new agents if the server is still using certificates generated by an older WhatsUp Gold release.

This prevents an environment in which existing agents remain connected while newly deployed agents fail to establish a connection.

Workaround

Notes

Keyword Phrase

Last Modified Date

10/22/2026 1:18 AM