Skip to main content
This guide explains how to move Proxy Manager SSL analysis to the new built-in CA certificate before the current built-in CA certificate expires on September 25, 2026.
This page covers the CA certificate that Proxy Manager uses to sign traffic on its own ports. To migrate Bright Data proxy endpoints such as brd.superproxy.io to the new root certificate on port 44445, see Root certificate migration.

​
Do I need to take action?

Proxy Manager users need to act only when SSL analysis is enabled on at least one proxy port and Proxy Manager uses the built-in CA certificate.

​
How does the built-in certificate setting work?

The built-in certificate setting in Proxy Manager selects which built-in CA certificate signs SSL analysis traffic:
  • Old certificate: available temporarily during the transition period. The old certificate expires on September 25, 2026.
  • New certificate: recommended for continued use after September 25, 2026.
The setting affects only proxy ports with SSL analysis enabled.

​
How to switch to the new built-in certificate

Switch the Proxy Manager certificate setting and the client trust stores together, so HTTPS requests keep working.
  1. In Proxy Manager, set the built-in certificate setting to the new certificate.
  2. Install and trust the new Proxy Manager CA certificate on every device and application that sends traffic through Proxy Manager.
  3. Send a test HTTPS request through a Proxy Manager port with SSL analysis enabled and confirm the request succeeds without a certificate error.
If you switch to the new certificate without installing the new Proxy Manager CA certificate on a client, HTTPS requests from that client can fail with certificate validation errors.

​
How to use a custom CA certificate with on-premise Proxy Manager

On-premise Proxy Manager users can replace the built-in CA certificate with their own CA certificate and private key. If you already use a custom CA certificate, no action is required for this migration.
  1. Prepare a CA certificate and its matching private key. The certificate and the private key must form a valid matching pair.
  2. Name the files exactly:
    • lpm.crt: the CA certificate
    • lpm.key: the private key for lpm.crt
  3. Place both files in the Proxy Manager working directory.
  4. Restart Proxy Manager.
  5. Install and trust lpm.crt on every client that uses the proxy.
When valid lpm.crt and lpm.key files are present in the working directory, Proxy Manager uses the custom CA certificate regardless of the built-in certificate setting.
Keep lpm.key private. Only the Proxy Manager process should be able to read the lpm.key file.

​
Where is the Proxy Manager working directory?

The default Proxy Manager working directory depends on the operating system and on the user account that runs Proxy Manager. Two cases change the location:
  • Service account: when Proxy Manager runs under a service account, use that service account’s home directory in place of /home/<username> or C:\Users\<username>.
  • --dir option: when Proxy Manager starts with the --dir option, place lpm.crt and lpm.key in the directory that --dir specifies.

​
Why does the Proxy Manager CA certificate matter?

When SSL analysis is enabled, Proxy Manager decrypts HTTPS traffic so it can inspect and process each request. To do this, Proxy Manager generates a certificate for each requested website and signs that certificate with its own Certificate Authority (CA) certificate. Every client that sends HTTPS requests through a Proxy Manager port with SSL analysis enabled must trust the Proxy Manager CA certificate. When the CA certificate changes, clients that still trust only the old CA certificate reject the connection with a certificate validation error.

​
FAQ

​
What happens if I do nothing before September 25, 2026?

The current built-in Proxy Manager CA certificate expires on September 25, 2026, and the old certificate is available only during the transition period. Switch to the new built-in certificate, or to a custom CA certificate, before that date if SSL analysis is enabled on any Proxy Manager port.

​
Does this migration affect Proxy Manager ports without SSL analysis?

No. The built-in certificate setting affects only proxy ports with SSL analysis enabled. Ports with SSL analysis disabled need no action.

​
I already use a custom lpm.crt certificate. Do I need to do anything?

No. When valid lpm.crt and lpm.key files are present in the Proxy Manager working directory, Proxy Manager uses the custom certificate and ignores the built-in certificate setting.

​
Is this the same as the port 44445 root certificate migration?

No. The port 44445 migration replaces the root certificate on Bright Data proxy endpoints. This page covers the CA certificate that Proxy Manager uses for SSL analysis on its own ports. See Root certificate migration for the proxy endpoint change.