Initialize Agent via Satellite with Master certificate

icinga2 has a feature named ca-proxy

the /etc/icinga2/features-available/api.conf must allow the incoming request, but I think it is enabled by default on all agents, so every agent can act as a CA-Proxy