Add core_agent_ca_cert config option to pass --ca-cert to the Core Agent

CHANGELOG.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## Pending
+- Add `core_agent_ca_cert` config option to pass `--ca-cert` to the Core Agent
+
 ## [3.5.4] 2026-09-15
 - Fix FastMCP tool annotation tags (`read_only`/`idempotent`/`external`/`destructive`) under FastMCP 4.x (MCP SDK v2), which renamed the `ToolAnnotations` hint fields from camelCase to snake_case; reads now try snake_case then camelCase, keeping FastMCP 2.x/3.x support
 - Bump flake8 pre-commit hook to 7.3.0 for Python 3.12+ compatibility (pyflakes no longer crashes on `ast.Str`)

src/scout_apm/core/agent/manager.py

@@ -69,6 +69,7 @@ def run(self):
                         + self.log_file()
                         + self.config_file()
                         + self.socket_path()
+                        + self.ca_cert()
                     ),
                     close_fds=True,
                     stdout=devnull,
@@ -129,6 +130,14 @@ def config_file(self):
         else:
             return []
 
+    def ca_cert(self):
+        path = scout_config.value("core_agent_ca_cert")
+
+        if path is not None:
+            return ["--ca-cert", path]
+        else:
+            return []
+
     def verify(self):
         manifest = parse_manifest(self.core_agent_dir + "/manifest.json")
         if manifest is None:

src/scout_apm/core/config.py

@@ -63,6 +63,7 @@ def log(self) -> None:
         "app_server",
         "application_root",
         "collect_remote_ip",
+        "core_agent_ca_cert",
         "core_agent_config_file",
         "core_agent_dir",
         "core_agent_download",

tests/unit/core/agent/test_manager.py

@@ -93,6 +93,21 @@ def test_config_file_old_name_takes_precedence(self):
 
         assert result == ["--config-file", "foo"]
 
+    def test_ca_cert(self):
+        scout_config.set(core_agent_ca_cert="foo")
+
+        try:
+            result = CoreAgentManager().ca_cert()
+        finally:
+            scout_config.reset_all()
+
+        assert result == ["--ca-cert", "foo"]
+
+    def test_ca_cert_not_set(self):
+        result = CoreAgentManager().ca_cert()
+
+        assert result == []
+
 
 class TestParseManifest(object):
     def test_fail_does_not_exist(self, caplog, tmp_path):