# Symlinking mender-agent.pem to an external certificate

**URL:** <https://hub.mender.io/t/symlinking-mender-agent-pem-to-an-external-certificate/642>\
**Category:** General Discussions\
**Created:** [May 30, 2019, 2:16am UTC](https://hub.mender.io/t/symlinking-mender-agent-pem-to-an-external-certificate/642 "2019-05-30T02:16:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![samlewis](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/samlewis/32/393_2.png) [@samlewis](https://hub.mender.io/u/samlewis)\
**Post date:** [May 30, 2019, 2:16am UTC](https://hub.mender.io/t/symlinking-mender-agent-pem-to-an-external-certificate/642/1 "2019-05-30T02:16:24Z")

</div>

I’d like to set my mender images to symlink mender-agent.pem to an existing persistent certificate that is already present on each of my devices.

I currently have this working by adding `ln -s /config/certs/device_cert.key.rsa ${WORKDIR}/data/mender/mender-agent.pem` to `mender-part-images.bbclass` but I would like to have a less hacky way of doing this where I don’t need to patch the Mender source.

Is there a nice way of achieving this? Appreciate the help.

---

<div class="post-metadata">

**Author:** ![mirzak](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/mirzak/32/2056_2.png) [@mirzak](https://hub.mender.io/u/mirzak)\
**Post date:** [May 30, 2019, 9:53am UTC](https://hub.mender.io/t/symlinking-mender-agent-pem-to-an-external-certificate/642/2 "2019-05-30T09:53:29Z")

</div>

Which Yocto versions are you using? If you are on thud you can simply create this link in a mender\_%.bbappend as mender-part-images extract the /data directory from rootfs

---

<div class="post-metadata">

**Author:** ![drewmoseley](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/drewmoseley/32/47_2.png) [@drewmoseley](https://hub.mender.io/u/drewmoseley)\
**Post date:** [May 30, 2019, 2:17pm UTC](https://hub.mender.io/t/symlinking-mender-agent-pem-to-an-external-certificate/642/3 "2019-05-30T14:17:10Z")

</div>

You can also use a modified mender.service file which will create the certificate symlinks using an “ExecStartPre” command. If the cert already exist, mender will not try to create it. You can add that with a mender\_\*.bbappend file in your own layer.

---

<div class="post-metadata">

**Author:** ![samlewis](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/samlewis/32/393_2.png) [@samlewis](https://hub.mender.io/u/samlewis)\
**Post date:** [May 30, 2019, 11:36pm UTC](https://hub.mender.io/t/symlinking-mender-agent-pem-to-an-external-certificate/642/4 "2019-05-30T23:36:12Z")

</div>

> [@mirzak](#):
>
> Which Yocto versions are you using? If you are on thud you can simply create this link in a mender\_%.bbappend as mender-part-images extract the /data directory from rootfs

I’m on rocko, is there any way to achieve that with it?

> [@drewmoseley](#):
>
> You can also use a modified mender.service file which will create the certificate symlinks using an “ExecStartPre” command. If the cert already exist, mender will not try to create it. You can add that with a mender\_\*.bbappend file in your own layer.

Ah good point! Would prefer to do it prior to run time if possible but this isn’t a bad alternative if it’s not possible.