Managing the Agent Truststore with RTFCTL
Use the rtfctl agent-truststore command group to inspect and update the certificate authority (CA) certificates that the Runtime Fabric agent uses to establish mutually authenticated TLS (mTLS) connections with the Anypoint Platform control plane.
About the Agent Truststore
The Runtime Fabric agent communicates outbound with several MuleSoft services hosted in the Anypoint Platform control plane:
-
Anypoint Runtime Manager: deploys and manages Mule apps and API gateways
-
Anypoint API Manager: applies and enforces API policies
-
Anypoint Monitoring: collects runtime metrics and telemetry
-
Configuration Resolver: provides Mule app bundles and configuration at deploy time
Every one of these connections is protected by mTLS. The agent validates the server certificates against a set of trusted CA certificates stored in the agent truststore.
Truststore Management
Anypoint Platform control plane is backed by public CA root certificates, which are inherently long-lived and stable. Rotation of these certificates is infrequent. However, in cases where a rotation is required for security reasons, such as a CA compromise or a planned infrastructure change, add the new CA to the agent’s truststore before the old one is retired to maintain the mTLS connection between the Runtime Fabric agent and the control plane.
The rtfctl agent-truststore commands provide these operations directly through rtfctl, without requiring any additional tooling.
Commands
| Command | Description |
|---|---|
Print a summary of the agent truststore and |
|
Download the PKCS#12 truststore from the cluster secret to a local file |
|
Download the ca.pem bundle from the cluster secret to a local file |
|
Add certificates from a PEM file into a local PKCS#12 truststore |
|
Add certificates from one PEM file into another PEM bundle |
|
Upload a local PKCS#12 truststore into the cluster secret |
|
Upload a local PEM bundle into the cluster secret as ca.pem |
|
Merge a PEM into the cluster truststore and ca.pem in one step |
agent-truststore info
Prints a summary of the agent keystore secret, including all certificates loaded in the PKCS#12 truststore and ca.pem, along with their subjects, expiry dates, and days remaining.
-
Print a human-readable summary
rtfctl agent-truststore info --namespace rtf
-
Print machine-readable JSON output
rtfctl agent-truststore info -o json --namespace rtf
agent-truststore retrieve-agent-truststore
Downloads the agent-truststore.p12 file from the cluster secret to a local file. The password is read automatically from the truststore-password key in the secret.
rtfctl agent-truststore retrieve-agent-truststore -o agent-truststore-bk.p12 --namespace rtf
-
Override the secret name and the output file
rtfctl agent-truststore retrieve-agent-truststore --secret agent-keystore -o agent-truststore-bk.p12 --namespace rtf
agent-truststore retrieve-ca-pem
Downloads the ca.pem bundle from the cluster secret to a local file.
rtfctl agent-truststore retrieve-ca-pem -o ca-bk.pem --namespace rtf
agent-truststore merge-pem-into-p12
Adds the certificates from a PEM file into a local PKCS#12 truststore file (certificates-only format). Duplicate certificates are detected by subject and skipped.
rtfctl agent-truststore merge-pem-into-p12 -i agent-truststore-bk.p12 -c new-ca.pem -o agent-truststore-new.p12
agent-truststore merge-pem-into-pem
Merges certificates from one PEM file into another PEM bundle. Duplicate certificates are detected by subject and skipped.
rtfctl agent-truststore merge-pem-into-pem -i ca-bk.pem -c new-ca.pem -o ca-new.pem
agent-truststore update-truststore-in-secret
Uploads a local PKCS#12 file into the agent keystore secret, replacing the agent-truststore.p12 key.
rtfctl agent-truststore update-truststore-in-secret -i agent-truststore-new.p12 --namespace rtf
agent-truststore update-ca-pem-in-secret
Uploads a local PEM bundle into the agent keystore secret, replacing the ca.pem key.
rtfctl agent-truststore update-ca-pem-in-secret -i ca-new.pem --namespace rtf
agent-truststore refresh-secret-with-pem
Reads the current truststore and ca.pem from the cluster secret, merges the provided PEM into both, displays the certificate subjects to upload, and—after confirmation—patches the secret. Use --yes to skip the interactive prompts.
-
Interactive (asks for confirmation before each upload)
rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --namespace rtf
-
Non-interactive (suitable for automation)
rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --yes --namespace rtf
Workflows
Inspect the Current Truststore
Before making changes, review which certificates are loaded and when they expire:
rtfctl agent-truststore info --namespace rtf
Use -o json to get machine-readable output suitable for scripting or CI checks.
Add a New CA to the Truststore (Interactive)
Use refresh-secret-with-pem to retrieve the current truststore from the cluster, merge a new PEM file into both the PKCS#12 and PEM stores, preview the result, and upload it back in a single step:
rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --namespace rtf
The command prints the subjects of all certificates to upload and asks for confirmation before patching the secret.
To skip the confirmation prompts (for example, in automation):
rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --yes --namespace rtf
Add a New CA Manually
If you prefer full control over each operation, or if you need to work with local files before uploading:
-
Download the current truststore and CA PEM from the cluster:
rtfctl agent-truststore retrieve-agent-truststore -o agent-truststore-bk.p12 --namespace rtf rtfctl agent-truststore retrieve-ca-pem -o ca-bk.pem --namespace rtf
-
Merge the new CA certificates into the local files:
rtfctl agent-truststore merge-pem-into-p12 -i agent-truststore-bk.p12 -c new-ca.pem -o agent-truststore-new.p12 rtfctl agent-truststore merge-pem-into-pem -i ca-bk.pem -c new-ca.pem -o ca-new.pem
-
Upload the updated files back to the cluster:
rtfctl agent-truststore update-truststore-in-secret -i agent-truststore-new.p12 --namespace rtf rtfctl agent-truststore update-ca-pem-in-secret -i ca-new.pem --namespace rtf
-
Verify the result:
rtfctl agent-truststore info --namespace rtf