TigerTrust reaches into your infrastructure via a field agent — a small binary that runs on a host inside your network. Agents never accept inbound connections. They poll the TigerTrust Collector over outbound HTTPS on port 443, fetch work, execute it locally, and report back. This design removes the firewall and NAT problems that classic push-based CLM platforms face.

​
How it works

CUSTOMER NETWORK                          TIGERTRUST CLOUD
┌────────────┐    outbound HTTPS      ┌───────────────────┐
│   Agent    │ ────── poll ──────────►│    Collector      │
│            │                        │                   │
│            │◄──── tasks ────────────│                   │
│  execute   │                        │                   │
│  locally   │                        │                   │
│            │──── results ──────────►│                   │
│            │──── heartbeat ────────►│                   │
└────────────┘                        └───────────────────┘
Every 30 seconds the agent runs this cycle:
1

Heartbeat

The agent checks in with the Collector to confirm it is healthy and ready.
2

Fetch tasks

The agent retrieves any pending work assigned to it — certificate CSR generation, certificate deployment, discovery scans, SSH key rotation, or health checks.
3

Execute locally

The agent performs the task on the host. Private key material never leaves the host.
4

Report back

The agent sends results back to the Collector — the completed task outcome, a generated CSR, or scan findings.

​
Enrollment

Agents authenticate with an agent API key scoped to your workspace. Get one from Settings > API Keys > New key and select agent type. Install and enroll an agent with a single command: 
curl -fsSL https://releases.tigertrust.io/tigertrust-agent/scripts/install.sh | sudo bash -s -- \
  --collector-url https://collector.tigertrust.io \
  --api-key ak_prod_...
The installer configures the agent as a system service. On first heartbeat, TigerTrust creates the agent record in your workspace (defaulting to the hostname) and marks it active. For additional security, you can enable mutual TLS so the Collector pins the agent’s client certificate fingerprint during enrollment.

​
Task types

Agents accept five types of work:
Task typePurpose
CSR generationGenerate a certificate signing request from a key already on the host
Certificate deploymentWrite a renewed certificate to disk, a Java keystore, a Kubernetes secret, or a cloud key store
Discovery scanFilesystem, keystore, network, or Kubernetes discovery scan
Key rotationGenerate a fresh keypair alongside the existing certificate
Health checkVerify agent responsiveness and local dependencies
Tasks have a priority (low, normal, high, critical) and a retry limit. Failed tasks are retried with exponential backoff.

​
Agent capabilities

Agents advertise what operations they support. The control plane only assigns tasks the agent claims to support. This means a stripped-down IoT agent (discovery and renewal only) can coexist with a full-featured data-center agent in the same workspace without routing errors. Common capability combinations:
  • Full: filesystem scan, keystore scan, Kubernetes scan, certificate renewal, deployment, network scan, SSH scan
  • IoT/edge: filesystem scan, certificate renewal only
Capabilities are displayed on the agent’s detail panel in Infrastructure > Agents.

​
The Collector

The Collector is the lightweight HTTPS service that agents communicate with. It is the only TigerTrust component that must be reachable by agents — the rest of TigerTrust (the product UI, PKI Core) can remain on a private network.
The Collector must be reachable by your field agents on port 443. Everything else in TigerTrust can be fully private.

​
What agents deliberately do not do

  • They do not accept any inbound connection on any port.
  • They do not upload private key material (unless a policy explicitly opts in for escrow scenarios).
  • They do not hold persistent TCP connections — every interaction is a short-lived HTTPS request.
These constraints make the agent auditable, easy to firewall, and safe to run in regulated environments.

Certificate renewal

How CSR generation and deployment tasks work end-to-end during renewal.

Discovery

The scan types agents can perform.

Infrastructure

Register and manage agents from the infrastructure view.