Who rated this post

Hi @dgagnon ,

When you enable this feature , it , makes the agent not to use the Local Root CA certificate Store anymore and use only the pinned roots.pem certificate file, this PEM file is downloaded with content updates  , which you can see it under the content folder directory - C:\ProgramData\Cyvera\LocalSystem\Download\content

As seen below

When the agent starts, restarts, or installed, the roots.pem file gets copied and loaded into the configuration and you can see it under the config directory - C:\Program Files\Palo Alto Networks\Traps\config\roots.pem
As seen below

This will give you the assurance that the agent will use the roots.pem.

One more thing i would recommend here, is to also enable the newly introduced field, field “LAST CERTIFICATE ENFORCEMENT FALLBACK” under the Endpoint --> All Endpoints to have this as a check point and see if the agent fallback to use its local store to validate certificates.

Hope that helped!

If that answered the question please feel free to mark this as a solution so other can benefit from!

Best,
Z