Skip to main content
ikish
Staff
Staff
October 28, 2025

Technical Tip: Remote shell functionality in on-premises environments was disrupted due to certificate expiration

  • October 28, 2025
  • 0 replies
  • 15084 views

 

Description This article describes how to replace an expired certificate in an on-premises Remote Shell deployment.  
Scope Threat Hunting Repository version MW-7.2.0.0057_STR-6.0.1.0007 and below.
Solution

To deploy the fix of replacing the expired Remote Shell certificate,  follow the steps below:

 

  1. Deliver the 'RSHELL_CERT.tar' file, which can be provided by TAC upon request, to the THR machine.
  2. Log in to the THR machine using SSH and extract the RSHELL_CERT.tar file:

 

tar xvf RSHELL_CERT.tar

  1. Change directory to the 'remote_shell_cert ' folder:

 

cd remote_shell_cert

  1. Execute the script for replacing the certificate in the 'remote shell' deployment:

 

bash replace_cert.sh

  1. Wait for the output:

 

Patching Remoteshell secret...
secret/edr2-onprem-remoteshell-certs patched
Restarting Remoteshell deployment...
deployment.apps/edr2-onprem-remoteshell restarted
Successfully patched secret and restarted deployment.

  1. Make sure that a new 'remoteshell' pod has been created using the command:


kubectl get pods -n edr2-onprem

  1. Validate that the remote shell functionally to the collectors is available again.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!