---
schema_version: "1"
id: 2f60d7a69340aa1a3dd9edf8a59306a30c8c24ea3601e081720677208a7d218d
title: Managing the Agent Truststore with RTFCTL
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-fabric/latest/manage-agent-truststore-rtfctl.md
canonical_url: https://docs.mulesoft.com/runtime-fabric/latest/manage-agent-truststore-rtfctl
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 5b62f14b39879e0dfdd443926ff6d29bb20ccee540c3f090554525d83ad32ca6
description: MuleSoft Documentation Site
release: "3.0"
latest: true
---
---
product: Runtime Fabric
version: 3.0
is-latest-version: true
---

# Managing the Agent Truststore with RTFCTL

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Use the `rtfctl agent-truststore` command group to inspect and update the certificate authority (CA)
certificates that the Runtime Fabric agent uses to establish mutually authenticated TLS (mTLS)
connections with the Anypoint Platform control plane.

## About the Agent Truststore

The Runtime Fabric agent communicates outbound with several MuleSoft services hosted in the Anypoint
Platform control plane:

- Anypoint Runtime Manager: deploys and manages Mule apps and API gateways

- Anypoint API Manager: applies and enforces API policies

- Anypoint Monitoring: collects runtime metrics and telemetry

- Configuration Resolver: provides Mule app bundles and configuration at deploy time

Every one of these connections is protected by mTLS. The agent validates the server certificates
against a set of trusted CA certificates stored in the agent truststore.

## Truststore Management

Anypoint Platform control plane is backed by public CA root certificates, which are inherently
long-lived and stable. Rotation of these certificates is infrequent. However, in cases where a
rotation is required for security reasons, such as a CA compromise or a planned infrastructure
change, add the new CA to the agent’s truststore before the old one is retired to maintain the mTLS
connection between the Runtime Fabric agent and the control plane.

The `rtfctl agent-truststore` commands provide these operations directly through `rtfctl`, without
requiring any additional tooling.

## Commands

<table><colgroup><col> <col></colgroup><thead><tr><th>Command</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><a href="#agent-truststore-info"><code>agent-truststore info</code></a></p></div></div></td><td><div><div><p>Print a summary of the agent truststore and <code>ca.pem</code></p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-retrieve-truststore"><code>agent-truststore retrieve-agent-truststore</code></a></p></div></div></td><td><div><div><p>Download the PKCS#12 truststore from the cluster secret to a local file</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-retrieve-ca-pem"><code>agent-truststore retrieve-ca-pem</code></a></p></div></div></td><td><div><div><p>Download the ca.pem bundle from the cluster secret to a local file</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-merge-p12"><code>agent-truststore merge-pem-into-p12</code></a></p></div></div></td><td><div><div><p>Add certificates from a PEM file into a local PKCS#12 truststore</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-merge-pem"><code>agent-truststore merge-pem-into-pem</code></a></p></div></div></td><td><div><div><p>Add certificates from one PEM file into another PEM bundle</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-update-truststore"><code>agent-truststore update-truststore-in-secret</code></a></p></div></div></td><td><div><div><p>Upload a local PKCS#12 truststore into the cluster secret</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-update-ca-pem"><code>agent-truststore update-ca-pem-in-secret</code></a></p></div></div></td><td><div><div><p>Upload a local PEM bundle into the cluster secret as ca.pem</p></div></div></td></tr><tr><td><div><div><p><a href="#agent-truststore-refresh"><code>agent-truststore refresh-secret-with-pem</code></a></p></div></div></td><td><div><div><p>Merge a PEM into the cluster truststore and ca.pem in one step</p></div></div></td></tr></tbody></table>

## `agent-truststore info`

Prints a summary of the agent keystore secret, including all certificates loaded in the PKCS#12
truststore and ca.pem, along with their subjects, expiry dates, and days remaining.

- Print a human-readable summary

  rtfctl agent-truststore info --namespace rtf

- Print machine-readable JSON output

  rtfctl agent-truststore info -o json --namespace rtf

## `agent-truststore retrieve-agent-truststore`

Downloads the `agent-truststore.p12` file from the cluster secret to a local file. The password is
read automatically from the `truststore-password` key in the secret.

rtfctl agent-truststore retrieve-agent-truststore -o agent-truststore-bk.p12 --namespace rtf

- Override the secret name and the output file

  rtfctl agent-truststore retrieve-agent-truststore --secret agent-keystore -o
  agent-truststore-bk.p12 --namespace rtf

## `agent-truststore retrieve-ca-pem`

Downloads the `ca.pem` bundle from the cluster secret to a local file.

rtfctl agent-truststore retrieve-ca-pem -o ca-bk.pem --namespace rtf

## `agent-truststore merge-pem-into-p12`

Adds the certificates from a PEM file into a local PKCS#12 truststore file (certificates-only
format). Duplicate certificates are detected by subject and skipped.

rtfctl agent-truststore merge-pem-into-p12 -i agent-truststore-bk.p12 -c new-ca.pem -o
agent-truststore-new.p12

## `agent-truststore merge-pem-into-pem`

Merges certificates from one PEM file into another PEM bundle. Duplicate certificates are detected
by subject and skipped.

rtfctl agent-truststore merge-pem-into-pem -i ca-bk.pem -c new-ca.pem -o ca-new.pem

## `agent-truststore update-truststore-in-secret`

Uploads a local PKCS#12 file into the agent keystore secret, replacing the `agent-truststore.p12`
key.

rtfctl agent-truststore update-truststore-in-secret -i agent-truststore-new.p12 --namespace rtf

## `agent-truststore update-ca-pem-in-secret`

Uploads a local PEM bundle into the agent keystore secret, replacing the `ca.pem` key.

rtfctl agent-truststore update-ca-pem-in-secret -i ca-new.pem --namespace rtf

## `agent-truststore refresh-secret-with-pem`

Reads the current truststore and `ca.pem` from the cluster secret, merges the provided PEM into
both, displays the certificate subjects to upload, and—after confirmation—patches the secret. Use
`--yes` to skip the interactive prompts.

- Interactive (asks for confirmation before each upload)

  rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --namespace rtf

- Non-interactive (suitable for automation)

  rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --yes --namespace rtf

## Workflows

### Inspect the Current Truststore

Before making changes, review which certificates are loaded and when they expire:

rtfctl agent-truststore info --namespace rtf

Use `-o json` to get machine-readable output suitable for scripting or CI checks.

### Add a New CA to the Truststore (Interactive)

Use `refresh-secret-with-pem` to retrieve the current truststore from the cluster, merge a new PEM
file into both the PKCS#12 and PEM stores, preview the result, and upload it back in a single step:

rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --namespace rtf

The command prints the subjects of all certificates to upload and asks for confirmation before
patching the secret.

To skip the confirmation prompts (for example, in automation):

rtfctl agent-truststore refresh-secret-with-pem -c new-ca.pem --yes --namespace rtf

### Add a New CA Manually

If you prefer full control over each operation, or if you need to work with local files before
uploading:

1.  Download the current truststore and CA PEM from the cluster:

    rtfctl agent-truststore retrieve-agent-truststore -o agent-truststore-bk.p12 --namespace rtf
    rtfctl agent-truststore retrieve-ca-pem -o ca-bk.pem --namespace rtf

2.  Merge the new CA certificates into the local files:

    rtfctl agent-truststore merge-pem-into-p12 -i agent-truststore-bk.p12 -c new-ca.pem -o
    agent-truststore-new.p12 rtfctl agent-truststore merge-pem-into-pem -i ca-bk.pem -c new-ca.pem
    -o ca-new.pem

3.  Upload the updated files back to the cluster:

    rtfctl agent-truststore update-truststore-in-secret -i agent-truststore-new.p12 --namespace rtf
    rtfctl agent-truststore update-ca-pem-in-secret -i ca-new.pem --namespace rtf

4.  Verify the result:

    rtfctl agent-truststore info --namespace rtf

## See Also

- [Runtime Fabric Security Architecture](https://docs.mulesoft.com/runtime-fabric/latest/security-architecture)

- [Using RTFCTL for Runtime Fabric](https://docs.mulesoft.com/runtime-fabric/latest/using-rtfctl-rtf)

- [RTFCTL Reference](https://docs.mulesoft.com/runtime-fabric/latest/rtfctl-reference)