Install the CLM Agent

The TigerTrust Agent is the only thing you install on a host to bring it under CLM management. It never listens on any port; it dials out to the Collector on 443 and pulls work.

This page mirrors the Agent Setup wizard in the dashboard (/clm/agent-setup). Copy commands from either side — they’re identical.

Prerequisites

Requirement	Value
Agent API Key	Create one in Settings → API Keys → New key with type `agent`. Shown once.
Collector URL	`https://collector.tigertrust.io` (or your self-hosted Collector)
Supported OS	Debian/Ubuntu · RHEL/CentOS · Windows Server 2016+ · macOS 12+
User	`root` or a service account that owns the paths you plan to manage

Quick install (one script, any Linux)

Run the installer

curl -fsSL https://releases.tigertrust.io/tigertrust-agent/scripts/install.sh | sudo bash -s -- \
  --collector-url https://collector.tigertrust.io \
  --api-key YOUR_API_KEY

The script detects your distro, adds the right package repo, installs tigertrust-agent, writes /etc/tigertrust-agent/config.yaml, and enables the systemd service.

Verify

sudo systemctl status tigertrust-agent

The host appears in Infrastructure → Agents within 30 seconds of first heartbeat.

Installation methods

Choose the flow that matches your platform. All flows land on the same tigertrust-agent binary and /etc/tigertrust-agent/config.yaml.

Debian / Ubuntu
RHEL / CentOS
Windows
Manual (tarball)
Docker

Add the TigerTrust repository

curl -fsSL https://releases.tigertrust.io/tigertrust-agent/latest/gpg.key \
  | sudo gpg --dearmor -o /usr/share/keyrings/tigertrust-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/tigertrust-archive-keyring.gpg] https://releases.tigertrust.io/tigertrust-agent/latest/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/tigertrust.list

Update package list and install

sudo apt update && sudo apt install -y tigertrust-agent

Configure the agent

sudo tigertrust-agent configure \
  --collector-url https://collector.tigertrust.io \
  --api-key YOUR_API_KEY

Start the service

sudo systemctl enable --now tigertrust-agent

Add the TigerTrust repository

sudo tee /etc/yum.repos.d/tigertrust.repo << 'EOF'
[tigertrust]
name=TigerTrust Repository
baseurl=https://releases.tigertrust.io/tigertrust-agent/latest/yum/stable
enabled=1
gpgcheck=1
gpgkey=https://releases.tigertrust.io/tigertrust-agent/latest/gpg.key
EOF

Install the agent

sudo yum install -y tigertrust-agent

Configure the agent

sudo tigertrust-agent configure \
  --collector-url https://collector.tigertrust.io \
  --api-key YOUR_API_KEY

Start the service

sudo systemctl enable --now tigertrust-agent

Windows Server 2016+ or Windows 10/11 with PowerShell 5.1+. Run every step in an elevated PowerShell session.

Download and install

Invoke-WebRequest `
  -Uri "https://releases.tigertrust.io/tigertrust-agent/latest/tigertrust-agent-windows-amd64.msi" `
  -OutFile "$env:TEMP\tigertrust-agent.msi"

Start-Process msiexec.exe -ArgumentList "/i", "$env:TEMP\tigertrust-agent.msi", "/quiet", "/norestart" -Wait

Configure the agent

& "C:\Program Files\TigerTrust\tigertrust-agent.exe" configure `
  --collector-url https://collector.tigertrust.io `
  --api-key YOUR_API_KEY

Start and enable the Windows service

Start-Service TigerTrustAgent
Set-Service  TigerTrustAgent -StartupType Automatic
Get-Service  TigerTrustAgent

Download the binary

curl -LO https://releases.tigertrust.io/tigertrust-agent/latest/tigertrust-agent-linux-amd64.tar.gz
tar -xzf tigertrust-agent-linux-amd64.tar.gz
cd tigertrust-agent

Install to system

sudo mv tigertrust-agent /usr/local/bin/
sudo chmod +x /usr/local/bin/tigertrust-agent
sudo mkdir -p /etc/tigertrust-agent /var/log/tigertrust-agent

Create the config file

sudo nano /etc/tigertrust-agent/config.yaml

Use the Configuration tab on /clm/agent-setup to generate the exact YAML for your discovery + renewal preferences.

Create the systemd service

sudo tee /etc/systemd/system/tigertrust-agent.service << 'EOF'
[Unit]
Description=TigerTrust Agent
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/tigertrust-agent --config /etc/tigertrust-agent/config.yaml
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now tigertrust-agent

Option A — environment variables

docker run -d \
  --name tigertrust-agent \
  --restart unless-stopped \
  -e COLLECTOR_URL=https://collector.tigertrust.io \
  -e API_KEY=YOUR_API_KEY \
  -e AGENT_NAME=docker-agent-01 \
  -v /etc/ssl:/etc/ssl:ro \
  -v /etc/pki:/etc/pki:ro \
  -v /var/lib/certificates:/var/lib/certificates:ro \
  tigertrust/agent:latest

Option B — mounted config file

docker run -d \
  --name tigertrust-agent \
  --restart unless-stopped \
  -v /path/to/config.yaml:/etc/tigertrust-agent/config.yaml:ro \
  -v /etc/ssl:/etc/ssl:ro \
  -v /etc/pki:/etc/pki:ro \
  tigertrust/agent:latest

Docker Compose

version: '3.8'
services:
  tigertrust-agent:
    image: tigertrust/agent:latest
    container_name: tigertrust-agent
    restart: unless-stopped
    environment:
      - COLLECTOR_URL=https://collector.tigertrust.io
      - API_KEY=YOUR_API_KEY
      - AGENT_NAME=docker-agent-01
    volumes:
      - /etc/ssl:/etc/ssl:ro
      - /etc/pki:/etc/pki:ro
      - /var/lib/certificates:/var/lib/certificates:ro

Verify the install

Check service status

sudo systemctl status tigertrust-agent

Tail agent logs

sudo journalctl -u tigertrust-agent -f

Once connected, the host appears in Infrastructure → Agents within a few seconds and starts discovering certificates automatically.

The `install.sh` script

Every distro-specific flow above is what the single install.sh runs internally. It’s fetched from https://releases.tigertrust.io/tigertrust-agent/scripts/install.sh and:

Detects the platform (/etc/os-release, uname -m).
On Debian/Ubuntu, imports the GPG key and adds the apt source; on RHEL/CentOS, drops the .repo file.
Installs the tigertrust-agent package.
Runs tigertrust-agent configure with the flags you passed on the curl line.
Enables and starts the systemd service.

Supported flags:

--collector-url <url>     (required)
--api-key <key>           (required)
--agent-name <name>       optional; defaults to hostname
--config <path>           optional; use a pre-written config file
--channel <stable|beta>   optional; default: stable

Capabilities

Agents advertise what they support. A discovery-only agent claims different capabilities than a data-center agent that also deploys certs. Edit /etc/tigertrust-agent/config.yaml and restart:

agent:
  capabilities:
    - fs-scan
    - cert-renewal
    - csr-generation
    - cert-deploy
    - network-scan
    - ssh-scan

The control plane only schedules tasks the agent claims to support, so a stripped-down IoT agent (discovery + renewal only) can coexist with full-featured hosts in the same workspace.

Agents and Collector

The pull-based architecture, task types, and enrollment flow.

Discovery

What the filesystem, keystore, and network scans actually look at.

Certificate renewal

End-to-end CSR generation and deployment during renewal.

Troubleshooting

Common enrollment and connectivity issues.

​Prerequisites

​Quick install (one script, any Linux)

​Installation methods

​Verify the install

Check service status

Tail agent logs

​The install.sh script

​Capabilities

​Related

Agents and Collector

Discovery

Certificate renewal

Troubleshooting

Prerequisites

Quick install (one script, any Linux)

Installation methods

Verify the install

The `install.sh` script

Capabilities

Related