<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1400" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hmm; I hacked daemon (so that it generates keys
valid for 10 years) and it took only 3 hours to clean old keys and restart
agents on 100 servers (so if you have 1000 servers, you can complete everything
in a week -:) even without automation). Btw, X509 do not allow to generate keys
valid for 100 years -:).</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Anyway, it should have some bypass and long term
solution; long term can be _allow 2 different certificates to coexist, and push
new certificate if agent have old one); short term - some script. I find pretty
simple GUI for windows, allowing to install service remotely (having simple exe
file), which can be used for remote agent installation; may be, something like
this can be done in this case as well (change of certificate, change of central
server, etc).</FONT></DIV></BODY></HTML>