diff --git a/debian/icinga2-common.install b/debian/icinga2-common.install
index 9c45736a1..f7cd060c8 100644
--- a/debian/icinga2-common.install
+++ b/debian/icinga2-common.install
@@ -2,7 +2,7 @@ debian/tmp/etc/icinga2
 usr/bin/icinga2-build*
 usr/bin/icinga2-sign-key
 usr/bin/icinga2-migrate-config
-usr/bin/icinga2-discover-agent
 usr/sbin/icinga2-*-feature
 usr/sbin/icinga2-setup-agent
+usr/sbin/icinga2-discover-agent
 usr/share/icinga2
diff --git a/tools/CMakeLists.txt b/tools/CMakeLists.txt
index 67a071a30..a8f57613c 100644
--- a/tools/CMakeLists.txt
+++ b/tools/CMakeLists.txt
@@ -23,7 +23,7 @@ if(UNIX OR CYGWIN)
   configure_file(icinga2-discover-agent.cmake ${CMAKE_CURRENT_BINARY_DIR}/icinga2-discover-agent @ONLY)
 
   install(
-    FILES ${CMAKE_CURRENT_BINARY_DIR}/icinga2-enable-feature
+    FILES ${CMAKE_CURRENT_BINARY_DIR}/icinga2-enable-feature ${CMAKE_CURRENT_BINARY_DIR}/icinga2-discover-agent
     DESTINATION ${CMAKE_INSTALL_SBINDIR}
     PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
   )
@@ -31,7 +31,7 @@ if(UNIX OR CYGWIN)
   install(CODE "execute_process(COMMAND \"${CMAKE_COMMAND}\" -E create_symlink ./icinga2-enable-feature \"\$ENV{DESTDIR}${CMAKE_INSTALL_FULL_SBINDIR}/icinga2-disable-feature\")")
 
   install(
-    FILES ${CMAKE_CURRENT_SOURCE_DIR}/migration/icinga2-migrate-config ${CMAKE_CURRENT_BINARY_DIR}/icinga2-discover-agent
+    FILES ${CMAKE_CURRENT_SOURCE_DIR}/migration/icinga2-migrate-config
     DESTINATION ${CMAKE_INSTALL_BINDIR}
     PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
   )
diff --git a/tools/icinga2-discover-agent.cmake b/tools/icinga2-discover-agent.cmake
index de944480a..62625085a 100644
--- a/tools/icinga2-discover-agent.cmake
+++ b/tools/icinga2-discover-agent.cmake
@@ -144,12 +144,15 @@ ssl_sock.connect((host, port))
 
 cn = None
 
-for rdn in ssl_sock.getpeercert()["subject"][0]:
+subject = ssl_sock.getpeercert()["subject"]
+
+for prdn in subject:
+    rdn = prdn[0]
     if rdn[0] == "commonName":
         cn = rdn[1]
 
 if cn == None:
-    warning("Agent certificate does not have a commonName.")
+    warning("Agent certificate does not have a commonName:", repr(subject))
     sys.exit(1)
 
 ssl_sock.write('20:{"method":"get_crs"},')