Agent enrollment

Before an agent gets any rules, LEA Platform gives it an identity: a client certificate signed by your LEA server. From then on, the server only talks to agents that present a valid certificate (mTLS).

Deployment tokens

• Create tokens in Settings → Agent Deployment Tokens. Each token belongs to a group, so new hosts land in the right place.
• A token is shown only once when you create it. Copy it then.
• Optional limits: max uses and an expiry date. You can choose whether enrolled agents are activated automatically.
• Rotate a token to issue a new value; the old one keeps working for 24 hours so rollouts don't break.
• Revoke a token to stop new enrollments with it. Agents that already enrolled keep working.
• The same page issues gateway certificates for an Ansible/AWX gateway, and lets you revoke them.

First enrollment

1. Put the token in the agent's lea.conf as LEA_ENROLL_TOKEN.
2. On first start the agent creates its own key pair and sends a certificate request with the token.
3. The server issues a client certificate. The agent removes the token from lea.conf.
4. After the first successful mTLS call the host is locked to that certificate: only that certificate (or an approved re-enrollment) is accepted for that host.

Renewal before expiry is automatic, over the existing mTLS connection.

Signed server responses

The server signs its responses with an Ed25519 key. The agent pins that key and checks a timestamp window, so it only runs commands that really came from your LEA server. You can also pin the server's TLS public key.

Enrollment states

The hosts list has an Enrollment column and filter:

A second chip shows the certificate: Valid, Expiring (under 30 days), Expired or No certificate.

Automatic recovery by key proof

If an agent still has its private key but its certificate is lost, expired or no longer recognised (for example after a database restore), it signs a new request with its old key. The server checks the key against the one on record and issues a new certificate. No token or admin action needed; the event is audit-logged.

Re-enrolling from the console

Use this when a host lost its key (disk replaced, files deleted, cloned VM) and has no token. Nothing needs to be done on the host.

1. Filter Enrollment → Certificate error (or any state).
2. Open a host and click Re-enroll, or select several hosts (or all hosts matching the current filters) and click Re-enroll.
3. Choose a window from 1 minute to 24 hours (default 60 minutes) and click Open Window.
4. On its next ping each agent gets a new certificate and moves to Probation. Results and group membership are kept.
5. Check the hosts, select them and click Confirm. They return to mTLS enrolled and receive all rules again.

Close Window cancels a window that hasn't been used.

Why probation exists

A host's identifier is not a secret, so during an open window someone else could try to enroll first. LEA limits that:

• One request per window. Later requests are rejected.
• Probation. Until an admin confirms, the host never receives rules that use secret parameters.
• Conflict alarm. If a second request arrives, it is rejected and the host is marked Re-enrollment conflict.

Every step (window opened, closed, used, key proof, conflict, confirm) is written to the audit log.