Affected Regions

• us-east-1
• af-south-1
• ap-southeast-3

Affected Products

• Trend Micro Cloud One - Endpoint and Workload Security
• Trend Micro Vision One Server & Workload Protection

Affected Agent Versions

All Deep Security Agent (DSA) versions in the affected regions.

Why This Upgrade Is Happening

The RSA key length used in agent-side Heartbeat certificates is being increased from 2048-bit to 3072-bit. The longer key length provides stronger encryption, making it significantly more difficult for attackers to compromise the communication between the Deep Security Agent and Heartbeat Service nodes. This change aligns with current industry best practices and evolving security certification requirements.

RSA 3072-bit is an industry standard. Modern network infrastructure, including SSL inspection devices, is expected to support this change without issue. Customers using legacy or non-standard SSL inspection infrastructure should verify compatibility.

Certificate Files Updated

The certificate files rotated depend on the agent version installed:

• DSA versions below 20.0.0.1348: Only ds_agent.crt and ds_agent_dsm.crt are rotated. The ds_agent_dsm_ca.crt file does not exist for these versions and is not rotated.
• DSA version 20.0.0.1348 and later: All three files are rotated — ds_agent.crt, ds_agent_dsm.crt, and ds_agent_dsm_ca.crt.

Certificate File Locations

Linux/macOS:

• /var/opt/ds_agent/dsa_core/ds_agent_dsm_ca.crt
• /var/opt/ds_agent/dsa_core/ds_agent_dsm.crt
• /var/opt/ds_agent/dsa_core/ds_agent.crt

Windows:

• C:\ProgramData\Trend Micro\Deep Security Agent\dsa_core\ds_agent_dsm_ca.crt
• C:\ProgramData\Trend Micro\Deep Security Agent\dsa_core\ds_agent_dsm.crt
• C:\ProgramData\Trend Micro\Deep Security Agent\dsa_core\ds_agent.crt

What to Expect — No Action Required

The certificate rotation is fully automatic. No manual intervention is required:

• Certificates are rotated automatically at the agent's next regular heartbeat.
• No agent restart or redeployment is needed.
• No changes are required on the Manager or console.
• There is no impact to regular agent-manager communication and no downtime or performance impact.
• The rollout is targeted for completion by June 30, 2026 for all three regions.

Verifying the Certificate Upgrade

To confirm that the RSA 3072-bit certificates have been applied, run the following commands as an elevated user with appropriate permissions.

Linux/macOS

openssl x509 -in /var/opt/ds_agent/dsa_core/ds_agent_dsm_ca.crt -text -noout | grep -A1 "Public Key"
openssl x509 -in /var/opt/ds_agent/dsa_core/ds_agent_dsm.crt -text -noout | grep -A1 "Public Key"
openssl x509 -in /var/opt/ds_agent/dsa_core/ds_agent.crt -text -noout | grep -A1 "Public Key"

Windows (PowerShell / certutil)

certutil -dump "C:\ProgramData\Trend Micro\Deep Security Agent\dsa_core\ds_agent_dsm_ca.crt" | findstr /I /C:"Public Key Length"
certutil -dump "C:\ProgramData\Trend Micro\Deep Security Agent\dsa_core\ds_agent_dsm.crt" | findstr /I /C:"Public Key Length"
certutil -dump "C:\ProgramData\Trend Micro\Deep Security Agent\dsa_core\ds_agent.crt" | findstr /I /C:"Public Key Length"

Confirmation via System Event

When an agent's certificate has been successfully updated, System Event ID 702 — "Credentials Generated" will appear in the Manager/console for each updated agent.

Related Articles

• KA-0021406 — Updating self-signed Heartbeat certificates SSL/TLS encryption for Trend Micro Cloud One – Endpoint and Workload Security and Vision One Server & Workload Protection
• KA-0020700 — Updating Heartbeat SSL certificate from RSA 2048-bit to RSA 3072-bit SSL/TLS encryption for Trend Micro Cloud One – Endpoint and Workload Security and Vision One Server & Workload Protection

Questions or Concerns

For support assistance, contact TrendAI™ Technical Support.