> ## Documentation Index
> Fetch the complete documentation index at: https://docs.brightdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Proxy Manager SSL analysis CA migration

> Switch Proxy Manager SSL analysis to the new built-in CA certificate before the current one expires on September 25, 2026, or load a custom CA.

This guide explains how to move Proxy Manager SSL analysis to the new built-in CA certificate before the current built-in CA certificate expires on **September 25, 2026**.

<Note>
  This page covers the CA certificate that Proxy Manager uses to sign traffic on its own ports. To migrate Bright Data proxy endpoints such as `brd.superproxy.io` to the new root certificate on port `44445`, see [Root certificate migration](/general/account/ssl-certificate-migration).
</Note>

## Do I need to take action?

Proxy Manager users need to act only when SSL analysis is enabled on at least one proxy port and Proxy Manager uses the built-in CA certificate.

| Your setup                                                                 | Action required                                                                        |
| -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| SSL analysis is disabled on all proxy ports                                | None                                                                                   |
| On-premise Proxy Manager with a custom `lpm.crt` and `lpm.key`             | None. The custom certificate takes priority over the built-in certificate setting      |
| SSL analysis is enabled and Proxy Manager uses the built-in CA certificate | Switch to the new certificate and install it on every client before September 25, 2026 |

## How does the built-in certificate setting work?

The built-in certificate setting in Proxy Manager selects which built-in CA certificate signs SSL analysis traffic:

* **Old certificate:** available temporarily during the transition period. The old certificate expires on September 25, 2026.
* **New certificate:** recommended for continued use after September 25, 2026.

The setting affects only proxy ports with SSL analysis enabled.

## How to switch to the new built-in certificate

Switch the Proxy Manager certificate setting and the client trust stores together, so HTTPS requests keep working.

1. In Proxy Manager, set the built-in certificate setting to the new certificate.
2. Install and trust the new Proxy Manager CA certificate on every device and application that sends traffic through Proxy Manager.
3. Send a test HTTPS request through a Proxy Manager port with SSL analysis enabled and confirm the request succeeds without a certificate error.

<Warning>
  If you switch to the new certificate without installing the new Proxy Manager CA certificate on a client, HTTPS requests from that client can fail with certificate validation errors.
</Warning>

## How to use a custom CA certificate with on-premise Proxy Manager

On-premise Proxy Manager users can replace the built-in CA certificate with their own CA certificate and private key. If you already use a custom CA certificate, no action is required for this migration.

1. Prepare a CA certificate and its matching private key. The certificate and the private key must form a valid matching pair.
2. Name the files exactly:
   * `lpm.crt`: the CA certificate
   * `lpm.key`: the private key for `lpm.crt`
3. Place both files in the [Proxy Manager working directory](#where-is-the-proxy-manager-working-directory).
4. Restart Proxy Manager.
5. Install and trust `lpm.crt` on every client that uses the proxy.

When valid `lpm.crt` and `lpm.key` files are present in the working directory, Proxy Manager uses the custom CA certificate regardless of the built-in certificate setting.

<Warning>
  Keep `lpm.key` private. Only the Proxy Manager process should be able to read the `lpm.key` file.
</Warning>

## Where is the Proxy Manager working directory?

The default Proxy Manager working directory depends on the operating system and on the user account that runs Proxy Manager.

| Operating system | Account       | Default working directory                                                         |
| ---------------- | ------------- | --------------------------------------------------------------------------------- |
| Linux            | Standard user | `/home/<username>/proxy_manager`                                                  |
| Linux            | Root user     | `/root/proxy_manager`                                                             |
| Windows          | Any user      | `C:\Users\<username>\proxy_manager` (equivalent to `%USERPROFILE%\proxy_manager`) |

Two cases change the location:

* **Service account:** when Proxy Manager runs under a service account, use that service account's home directory in place of `/home/<username>` or `C:\Users\<username>`.
* **`--dir` option:** when Proxy Manager starts with the `--dir` option, place `lpm.crt` and `lpm.key` in the directory that `--dir` specifies.

## Why does the Proxy Manager CA certificate matter?

When SSL analysis is enabled, Proxy Manager decrypts HTTPS traffic so it can inspect and process each request. To do this, Proxy Manager generates a certificate for each requested website and signs that certificate with its own Certificate Authority (CA) certificate.

Every client that sends HTTPS requests through a Proxy Manager port with SSL analysis enabled must trust the Proxy Manager CA certificate. When the CA certificate changes, clients that still trust only the old CA certificate reject the connection with a certificate validation error.

## FAQ

### What happens if I do nothing before September 25, 2026?

The current built-in Proxy Manager CA certificate expires on September 25, 2026, and the old certificate is available only during the transition period. Switch to the new built-in certificate, or to a custom CA certificate, before that date if SSL analysis is enabled on any Proxy Manager port.

### Does this migration affect Proxy Manager ports without SSL analysis?

No. The built-in certificate setting affects only proxy ports with SSL analysis enabled. Ports with SSL analysis disabled need no action.

### I already use a custom lpm.crt certificate. Do I need to do anything?

No. When valid `lpm.crt` and `lpm.key` files are present in the Proxy Manager working directory, Proxy Manager uses the custom certificate and ignores the built-in certificate setting.

### Is this the same as the port 44445 root certificate migration?

No. The port `44445` migration replaces the root certificate on Bright Data proxy endpoints. This page covers the CA certificate that Proxy Manager uses for SSL analysis on its own ports. See [Root certificate migration](/general/account/ssl-certificate-migration) for the proxy endpoint change.