From 5ac81537f90fa5a384eba147fffa353034b7405c Mon Sep 17 00:00:00 2001
From: Jack Rothrock <jrothrock14@gmail.com>
Date: Mon, 14 Sep 2026 15:30:36 -0600
Subject: [PATCH] Add core_agent_ca_cert config option

Passes a configured CA certificate path through to the Core Agent
binary as a --ca-cert flag when launching it as a subprocess, mirroring
the existing --log-file/--config-file/--socket handling.
---
 CHANGELOG.md                          |  3 +++
 src/scout_apm/core/agent/manager.py   |  9 +++++++++
 src/scout_apm/core/config.py          |  1 +
 tests/unit/core/agent/test_manager.py | 15 +++++++++++++++
 4 files changed, 28 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 00133b3f..a981fb9d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## Pending
+- Add `core_agent_ca_cert` config option to pass `--ca-cert` to the Core Agent
+
 ## [3.5.4] 2026-09-15
 - Fix FastMCP tool annotation tags (`read_only`/`idempotent`/`external`/`destructive`) under FastMCP 4.x (MCP SDK v2), which renamed the `ToolAnnotations` hint fields from camelCase to snake_case; reads now try snake_case then camelCase, keeping FastMCP 2.x/3.x support
 - Bump flake8 pre-commit hook to 7.3.0 for Python 3.12+ compatibility (pyflakes no longer crashes on `ast.Str`)
diff --git a/src/scout_apm/core/agent/manager.py b/src/scout_apm/core/agent/manager.py
index df0650c7..613da31d 100644
--- a/src/scout_apm/core/agent/manager.py
+++ b/src/scout_apm/core/agent/manager.py
@@ -69,6 +69,7 @@ def run(self):
                         + self.log_file()
                         + self.config_file()
                         + self.socket_path()
+                        + self.ca_cert()
                     ),
                     close_fds=True,
                     stdout=devnull,
@@ -129,6 +130,14 @@ def config_file(self):
         else:
             return []
 
+    def ca_cert(self):
+        path = scout_config.value("core_agent_ca_cert")
+
+        if path is not None:
+            return ["--ca-cert", path]
+        else:
+            return []
+
     def verify(self):
         manifest = parse_manifest(self.core_agent_dir + "/manifest.json")
         if manifest is None:
diff --git a/src/scout_apm/core/config.py b/src/scout_apm/core/config.py
index 7e22b470..9300e113 100644
--- a/src/scout_apm/core/config.py
+++ b/src/scout_apm/core/config.py
@@ -63,6 +63,7 @@ def log(self) -> None:
         "app_server",
         "application_root",
         "collect_remote_ip",
+        "core_agent_ca_cert",
         "core_agent_config_file",
         "core_agent_dir",
         "core_agent_download",
diff --git a/tests/unit/core/agent/test_manager.py b/tests/unit/core/agent/test_manager.py
index f13cdc99..924e5aef 100644
--- a/tests/unit/core/agent/test_manager.py
+++ b/tests/unit/core/agent/test_manager.py
@@ -93,6 +93,21 @@ def test_config_file_old_name_takes_precedence(self):
 
         assert result == ["--config-file", "foo"]
 
+    def test_ca_cert(self):
+        scout_config.set(core_agent_ca_cert="foo")
+
+        try:
+            result = CoreAgentManager().ca_cert()
+        finally:
+            scout_config.reset_all()
+
+        assert result == ["--ca-cert", "foo"]
+
+    def test_ca_cert_not_set(self):
+        result = CoreAgentManager().ca_cert()
+
+        assert result == []
+
 
 class TestParseManifest(object):
     def test_fail_does_not_exist(self, caplog, tmp_path):