Icinga agent running as root unable to correctly renew/generate certificates because of permission problems

When the icinga agent is run as root on redhat servers (example redhat 8) there are issues with the certificate renewal process. Many agents go offline as their certificate renewal date arrives.

To Reproduce

Modify /etc/sysconfig/icinga2 so that the agent runs as root

Restart agent,
Wait for renewal/expiry date..
You should find issues with the certificate renewal process and all checks go into unknown state.

Your Environment

• Version used (icinga2 --version):
  icinga2 - The Icinga 2 network monitoring daemon (version: r2.14.5-1)

Copyright (c) 2012-2025 Icinga GmbH (https://icinga.com/)
License GPLv2+: GNU GPL version 2 or later https://gnu.org/licenses/gpl2.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

System information:
Platform: Red Hat Enterprise Linux
Platform version: 8.10 (Ootpa)
Kernel: Linux
Kernel version: 4.18.0-553.27.1.el8_10.x86_64
Architecture: x86_64

Build information:
Compiler: GNU 8.5.0
Build host: unknown
OpenSSL version: OpenSSL 1.1.1k FIPS 25 Mar 2021

Application information:

General paths:
Config directory: /etc/icinga2
Data directory: /var/lib/icinga2
Log directory: /var/log/icinga2
Cache directory: /var/cache/icinga2
Spool directory: /var/spool/icinga2
Run directory: /run/icinga2

Old paths (deprecated):
Installation root: /usr
Sysconf directory: /etc
Run directory (base): /run
Local state directory: /var

Internal paths:
Package data directory: /usr/share/icinga2
State path: /var/lib/icinga2/icinga2.state
Modified attributes path: /var/lib/icinga2/modified-attributes.conf
Objects path: /var/cache/icinga2/icinga2.debug
Vars path: /var/cache/icinga2/icinga2.vars
PID path: /run/icinga2/icinga2.pid

Additional context

The problem is present for masters and satellites as well as agents and it seems to stem from the fact that running Icinga as root does not seem to be completely compliant with the CA and the certificate renewal mechanism.
For our environment running as root is necessary otherwise there are too many restrictions and filters with security agents monitoring all commands executed on the systems.