--- schema_version: "1" id: 59d9158dae27c1a7c97acbd06db834195ee6b91341f4799dc5c861ac26b0aba2 title: Renew Server Certificates collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-manager/servers-cert-renewal.md canonical_url: https://docs.mulesoft.com/runtime-manager/servers-cert-renewal source_site: docs.mulesoft.com content_type: documentation content_hash: b66321e097e3b8f919a8e5d86cb8cb81b15692975e6609cebcef841b9f4a0ed1 description: MuleSoft Documentation Site latest: true --- --- product: Runtime Manager --- # Renew Server Certificates > For the full documentation index, see: https://docs.mulesoft.com/llms.txt [![logo hybrid active](/mulesoft/current/en-us/_/img/icons/hybrid-cloud.svg "Hybrid")Hybrid](deployment-strategies#hybrid-deployments)[ ![logo server active](/mulesoft/current/en-us/_/img/icons/server-cloud.svg "Anypoint Platform PCE")Private Cloud Edition](deployment-strategies#anypoint-platform-private-cloud-edition) Registering a Mule server in Anypoint Runtime Manager requires a valid certificate provisioned and signed by Runtime Manager. The certificate ensures secure communication between Runtime Manager and the Runtime Manager agent. When a server certificate expires, Runtime Manager displays `Disconnected` in the **Status** column for the server on the **Servers** page. The `mule_agent.log` file displays a message like the following: com.mulesoft.agent.transport.WSConnection: Failed attempt to connect nro. 1 to the web socket client at runtime-manager.anypoint.mulesoft.com: Connection refused. For applications deployed to the server, Runtime Manager displays `Unknown` in the **Status** column on the **Applications** page. ## View a Certificate Expiration Date To see the expiration date for a server: 1. From Anypoint Platform, select **Runtime Manager**. 2. Click the **Servers** tab. 3. Click the server name. For servers in a server group or cluster, click the server group or cluster name and then click the server name. The certificate expiration date appears on the server dashboard: ![Certificate expiration date on the Dashboard page](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-certificate.png) Figure 1. The arrow shows the **Certificate expiration date** on the **Dashboard** page. ## Renew a Certificate from Runtime Manager Before a certificate expires, you can renew it directly from Runtime Manager. You can renew a certificate for a specific server or multiple servers within a cluster or group. The status for the server must be `Running` to update its certificate. To renew a certificate for a standalone server: 1. From Anypoint Platform, select **Runtime Manager**. 2. Click the **Servers** tab. 3. Verify that the server status is `Running`. 4. Click the server name. ![Select Server](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-standalone-name.png) 5. Click **Settings**. 6. From the **Actions** menu, select **Renew Certificate**. ![Settings Tab](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-standalone-settings.png) 7. Select the checkbox to confirm your choice, and then click **Renew**. ![Confirm Renewal](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-standalone-renew.png) 8. Check **Certificate expiration date** to verify that the certificate is renewed successfully, and restart Mule runtime to start using the new certificates. To renew a certificate for servers in a cluster or group: 1. From Anypoint Platform, select **Runtime Manager**. 2. Click the **Servers** tab. 3. Verify that the server status is `Running`. 4. Click the group or cluster name. ![Select Group or Cluster](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-certificate-group-name.png) 5. Check the radio button to select the server or servers you want to update. 6. From the **Actions** menu, select **Renew Certificate**. ![Select Server](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-certificate-group-select-server.png) 7. Select the checkbox to confirm your choice, and then click **Renew**. ![Confirm Renewal](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-certificate-group-renew.png) 8. Check **Certificate expiration date** to verify that the certificate renewed successfully. If the **Renew Certificate** option in the **Actions** pull-down menu is not available after performing the previous steps, you may need to [update your **Agent** version](https://docs.mulesoft.com/runtime-manager/installing-and-configuring-runtime-manager-agent#update-the-agent.adoc). The **Server certificate renewal** feature, which enables you to renew server certificates directly from Runtime Manager, was introduced by Runtime Manager 2.8.4. This feature requires Runtime Manager Agent 1.10.0 or later. You can hover over the **Renew Certificate** option in the **Actions** pull-down menu, and a tooltip in the UI indicates you the minimum required Runtime Agent version. > [!NOTE] Renewing server certificates requires a manual runtime restart to start using the new > certificates. If renewing the unexpired certificate via Runtime Manager fails, follow the steps in [Renew a Certificate via the Command Line](#renew-a-certificate-via-the-command-line). ## Renew a Certificate via the Command Line You can use this method to renew a certificate even after it has expired. The agent connects with Runtime Manager using mutual SSL authentication and stores the key pair in the `$MULE_HOME/conf/mule-agent.jks` file. The key pair is valid for two years, after which the certificate expires and the connection with Runtime Manager terminates. > [!NOTE] Make sure you disable MFA before implementing these steps. To renew the agent key pair: 1. Download the appropriate `agent-certificate-renewer-{version}.jar` file for your Mule version from [Applications and Servers showing as Unknown and Disconnected state in Anypoint Runtime Manager due to expired key pair](https://help.salesforce.com/s/articleView?id=001118268&type=1). 2. Move the JAR file to `$MULE_HOME/bin` and ensure that you have execute permission. For example, on Linux, enter `chmod +xx agent-certificate-renewer-{version}.jar`. 3. Stop Mule. 4. Create a backup copy of the `$MULE_HOME/conf` directory. 5. From `$MULE_HOME/bin`, run one of the following commands, depending on how you authenticate with Anypoint Platform: - Nonfederated Use your Anypoint Platform credentials on the command line: `java -jar ./agent-certificate-renewer-{version}.jar -u -p ` - External identity Copy the registration token for the server from the **Runtime Manager > Servers > Add Server** popup screen and include it on the command line: ![Add Registration Token](/mulesoft/current/en-us/runtime-manager/_images/rtm-server-certificate-external-identity.png) And execute the following command: `java -jar ./agent-certificate-renewer-{version}.jar -H ` - Proxy connection Use your Anypoint Platform and proxy server credentials on the command line: `java -jar agent-certificate-renewer-{version}.jar -u -p -P ` - US MuleSoft Government Cloud Control Plane Use the following -r flag: `java -jar ./agent-certificate-renewer-{version}.jar -H -r us_gov` - EU Control Plane Use the following -r flag: `java -jar ./agent-certificate-renewer-{version}.jar -u -p -r eu1` The command displays the following messages: INFO: Connecting to Core Services to extract authentication token. INFO: Connecting to Runtime Manager to request a new certificate. INFO: Backing up current agent keystore. INFO: Generating and saving new keystore. ## See Also - [Servers](https://docs.mulesoft.com/runtime-manager/servers-about) - [Add Servers to Runtime Manager](https://docs.mulesoft.com/runtime-manager/servers-create) - [Shut Down, Restart, or Delete Servers](https://docs.mulesoft.com/runtime-manager/servers-actions) - [Monitoring Dashboards on Runtime Manager](https://docs.mulesoft.com/runtime-manager/monitoring-dashboards)