On Saturday May 30th, 2020, at 10:48 UTC, an SSL root certificate used to cross-sign some of the Datadog certificates expired, and caused some of your Agents to lose connectivity with Datadog endpoints. Because this root certificate is embedded in certain Agent versions, you will need to take action to restore connectivity.
Agent versions spanning 3.6.x to 5.32.6 embed the expired certificate and are affected.
Agent versions 6.x and 7.x are fine and don’t need to be updated.
Use the Agent Versions list in the Datadog UI to see the hostname, the Agent version that it’s running, and the status of that host.
Note: The previously recommended Python script that queries your Datadog account for hosts running impacted Agent versions has been deprecated in favor of the list now available in the application.
If you are currently running Agent 5.x on a 64-bit host, Datadog recommends upgrading to Agent 5.32.7+. This ensures that the Agent continues to function in a variety of different scenarios, with the minimum amount of changes.
sudo yum check-update && sudo yum install datadog-agent
sudo apt-get update && sudo apt-get install datadog-agent
Windows (from versions > 5.12.0): Download the Datadog Agent installer.
start /wait msiexec /qn /i ddagent-cli-latest.msi
More platforms and configuration management options detailed on the Agent install page.
The last compatible Agent released for 32-bit systems was 5.10.1. Follow the
Fixing without upgrading the Agent instructions for 32-bit hosts.
sudo rm -f /opt/datadog-agent/agent/datadog-cert.pem && sudo /etc/init.d/datadog-agent restart
If your Agent is configured to use a proxy, follow the dedicated section below instead.
Using the CLI
Using PowerShell, take the following actions for Agent
rm "C:\Program Files\Datadog\Datadog Agent\agent\datadog-cert.pem" restart-service -Force datadogagent
Note that for Agent versions
<= 5.11, the location will be different.
For users on the 32-bit Agent
<= 5.11 on 64-bit Windows the steps are:
rm "C:\Program Files (x86)\Datadog\Datadog Agent\files\datadog-cert.pem" restart-service -Force datadogagent
For all other users on Agent
<= 5.11 the steps are:
rm "C:\Program Files\Datadog\Datadog Agent\files\datadog-cert.pem" restart-service -Force datadogagent
Using the Windows GUI
datadog-cert.pem. You can locate this file in:
C:\Program Files\Datadog\Datadog Agent\agent\
C:\Program Files (x86)\Datadog\Datadog Agent\files\
C:\Program Files\Datadog\Datadog Agent\files\
Once the file is removed, restart the Datadog Service from the Windows Service Manager.
Datadog recommends keeping up to date and updating to the latest version of the Agent. Deployments set to auto-update will do so with 5.32.7.
Yes. The certificate is just a preset for the client to use and is not necessary to connect via SSL. Datadog Agent endpoints only accept SSL traffic.
This section applies to the Windows Agent 5.x (
<= 5.32.6), if the Agent is configured to either:
proxy_hostconfiguration option in
HTTPS_PROXYenvironment variable, or
use_curl_http_client: yesconfiguration option in
datadog.conf is located in
In this case, removing
datadog-cert.pem does not allow the Agent to regain connectivity to Datadog. Instead, take this action:
>= 5.12.0: replace the
datadog-cert.pemfile with the version that is shipped in 5.32.7. Using the Powershell CLI:
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/DataDog/dd-agent/5.32.7/datadog-cert.pem" -OutFile "C:\Program Files\Datadog\Datadog Agent\agent\datadog-cert.pem" restart-service -Force datadogagent
Windows Agent v5,
<= 5.11.x: set the following option in
datadog.conf using the
Datadog Agent Manager program provided by the Agent or by directly editing the
ca_certs: C:\Program Files (x86)\Datadog\Datadog Agent\files\ca-certificates.crt
ca_certs: C:\Program Files\Datadog\Datadog Agent\files\ca-certificates.crt
datadog.conf has been updated, restart the Datadog Service from the Windows Service Manager.