diff --git a/meshcentral-config-schema.json b/meshcentral-config-schema.json
index 154196d4..fc9d32c6 100644
--- a/meshcentral-config-schema.json
+++ b/meshcentral-config-schema.json
@@ -41,6 +41,7 @@
         "agentPortTls": { "type": "boolean", "default": true, "description": "Indicates if the agent-only port must perform TLS, this should be set to false if TLS is performed in front of this server." },
         "agentCoreDump": { "type": "boolean", "default": false, "description": "Automatically activates and transfers any agent crash dump files to the server in meshcentral-data/coredumps." },
         "agentCoreDumpUsers": { "type": "array", "description": "List of non-administrator users that have access to mesh agent crash dumps." },
+        "ignoreAgentHashCheck": { "type": "boolean", "default": false, "description": "When true, the agent no longer checked the TLS certificate of the server. This should be used for debugging only." },
         "exactPorts": { "type": "boolean", "default": false },
         "allowLoginToken": { "type": "boolean", "default": false },
         "allowFraming": { "type": "boolean", "default": false, "description": "When enabled, the MeshCentral web site can be embedded within another website's iframe." },
diff --git a/meshuser.js b/meshuser.js
index d2060db9..0abf78e9 100644
--- a/meshuser.js
+++ b/meshuser.js
@@ -1329,8 +1329,11 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
                         else if ((url.query.p == '4') || (url.query.p == '5')) { requiredNonRights = MESHRIGHT_NOFILES; }
 
                         // Add server TLS cert hash
-                        const tlsCertHash = parent.webCertificateHashs[domain.id];
-                        if (tlsCertHash != null) { command.servertlshash = Buffer.from(tlsCertHash, 'binary').toString('hex'); }
+                        var tlsCertHash = null;
+                        if (parent.parent.args.ignoreagenthashcheck !== true) {
+                            tlsCertHash = parent.webCertificateHashs[domain.id];
+                            if (tlsCertHash != null) { command.servertlshash = Buffer.from(tlsCertHash, 'binary').toString('hex'); }
+                        }
 
                         // Add user consent messages
                         command.soptions = {};
diff --git a/webserver.js b/webserver.js
index cb0b6948..9514227b 100644
--- a/webserver.js
+++ b/webserver.js
@@ -3217,8 +3217,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
             }
 
             // Instruct one of more agents to download a URL to a given local drive location.
-            var tlsCertHash = obj.webCertificateHashs[cmd.domain.id];
-            if (tlsCertHash != null) { tlsCertHash = Buffer.from(tlsCertHash, 'binary').toString('hex'); }
+            var tlsCertHash = null;
+            if (parent.args.ignoreagenthashcheck !== true) {
+                tlsCertHash = obj.webCertificateHashs[cmd.domain.id];
+                if (tlsCertHash != null) { tlsCertHash = Buffer.from(tlsCertHash, 'binary').toString('hex'); }
+            }
             for (var i in cmd.nodeids) {
                 obj.GetNodeWithRights(cmd.domain, cmd.user, cmd.nodeids[i], function (node, rights, visible) {
                     if ((node == null) || ((rights & 8) == 0) || (visible == false)) return; // We don't have remote control rights to this device