Skip to content

Renewing a Tenant Posture

A tenant posture is the signed statement that lets a tenant's endpoints offer Pause in the status menu, and lets any browser extensions it lists use the endpoint's local engine. Endpoints accept a posture for at most 7 days, and the key that signs it is kept offline -- the control plane cannot re-sign it. Whoever holds that key must re-sign and upload the posture every week.

When it expires

Every endpoint in the tenant refuses the expired document:

  • Pause is no longer available in the status menu, and a pause request is refused. A pause already running still resumes on schedule.
  • Browser extensions listed in the posture lose access to the endpoint's local engine.

The release channel of the installed build is not affected; no posture changes it.

The customer portal shows the posture's state on Mission Control and Endpoints -- valid, expiring soon, expired, or none uploaded -- and, when it has expired, which of these controls are off. Platform administrators also see every tenant on the admin dashboard, and -- when the deployment has a mail server and recipients configured -- are emailed 48 hours before expiry, 24 hours before, and on expiry. The dashboard shows whether each warning was actually handed to the mail server.

Renew it

  1. On the offline machine that holds the posture signing key:

    python3 agents/endpoint-agent/tools/sign_tenant_posture.py sign \
  --tenant-id <tenant> --posture <unregulated|regulated> [--allow-pause] \
  --serial <current serial + 1> --validity-days 7 \
  --key <path to the private key> --key-id <key id> \
  --out <tenant>-posture.json

    The serial must be higher than the current one (the portal shows it). Keep the same posture and permissions unless you mean to change them.

  2. Copy only the signed JSON file -- never the key -- to the control-plane host.

  3. Upload it there:

    curl -sS -X PUT http://127.0.0.1:8000/admin/tenant-posture/<tenant> \
  -H "x-api-key: $CYBERARMOR_API_SECRET" \
  -H "content-type: application/json" \
  --data @<tenant>-posture.json

  4. The portal now shows the posture as valid with the new expiry. Endpoints pick it up on their next posture sync; a device that was offline gets it when it reconnects.