Dashboard known issues

Limitations that are real and current, so you find out here rather than halfway through a rollout. Each one says what the workaround is.

Shared-mode certificate policies are unavailable

The certificate-policy form shows two modes, and One shared certificate cannot be selected. The API refuses it too.

The reason is structural rather than a missing feature: every agent generates its own key and CSR locally, and the private key never leaves that host. A fan-out to N members would therefore issue N independent certificates, all writing their serial, fingerprint and status onto one certificate row - the last to finish wins.

Workaround. For nodes with individual names, use a per-agent policy. For identical replicas behind one hostname, issue one certificate to a single agent whose deploy target is the load balancer in front of them.

Monitoring integrations cannot be filtered

Every enabled monitoring integration receives every alert-worthy event. There is no per-integration minimum severity or event-type filter to configure.

Workaround. Filter on the receiving side. The payload carries severity and event_type on every sink.

A failed integration delivery is not retried

A webhook, syslog or SNMP delivery that fails is recorded on the integration - status, timestamp and a short error - and dropped. There is no delivery queue and no retry.

Workaround. Watch the last-delivery status on the integrations page, and treat a persistent failure as a configuration problem rather than a transient one.

There is no general public API

The only documented machine-facing surface is the Prometheus monitoring API. Everything else the dashboard does runs over an internal API that is not documented or supported for third-party use, and that can change without notice.

Export is limited to your own account data

Settings > Profile > Your data exports your profile and organization memberships as JSON. There is no self-service export of certificates, jobs or the event log, so a retention window that lapses takes its contents with it.

Workaround. If a compliance requirement needs a longer trail than your plan keeps, ask before it ages out.

An agent's credential cannot be rotated in place

There is no rotate operation for an enrolled agent. The only ways to give a host new credentials are Re-register on the agent - which mints a token scoped to that agent and updates it in place - or revoking it and enrolling a new one.

Enrollment tokens are short-lived

Every enrollment token expires one hour after it is created, and a multi-provision token is capped at 500 redemptions. That is fine for an interactive install and awkward for a golden image.

Workaround. Mint the token as part of the provisioning run rather than baking one into an artifact.

Most third-party deploy targets have not been exercised against real hardware

Every deploy target is implemented against its vendor's own documented API, but only a handful have been run against the real product. Sophos Firewall and WatchGuard Firebox go further: the vendors publish no example success or error response for the operations involved. The full breakdown is on Deploy targets.

Workaround. Validate a new target in a staging environment before a production renewal depends on it.

A custom-script deploy target receives no certificate material

It runs your hook with your variables in its environment. It does not write the certificate, chain or key anywhere and passes no paths to the script.

Workaround. Give the certificate a second deploy target that writes the files, or have the script fetch the material from wherever your environment keeps it. See Deploy targets.

Reporting something that is not on this list

Help > Report a Bug in the dashboard. Include the certificate's common name and the error text from the failed job.