Verifying Kernel Compatibility

Thales maintains a compatibility matrix in a JSON file that maps all CTE Agent releases to the Operating Systems and kernels that support those releases. The information in this file allows you to verify the compatibility between any Linux host and the version of the CTE Agent that you want to install on that host.

You can view the current compatibility information in CipherTrust Manager by downloading the most recent compatibility JSON file from Thales and then uploading it to CipherTrust Manager. After the JSON file has been uploaded, the CipherTrust Manager displays the compatibility of all Linux hosts registered with the CipherTrust Manager in the Compatibility View on the Hosts page.

For details about how to do this in CipherTrust Manager refer to: Kernel Compatibility Matrix.

The following procedure describes how to download the compatibility JSON file and verify its authenticity.

1. Download the cte_compatibility_matrix.tgz file from https://packages.vormetric.com/pub/ or from the Thales Customer Support Portal.

2. Extract the files from the TGZ file. The resulting files are:

   • CTE_Compatibility_Matrix_Cert_mm-dd-yyyy.pem — The X.509 Public Key Certificate.

   • cte_compatibility_matrix.json — The compatibility JSON file.

   • cte_compatibility_matrix.sign.sha256 — The SHA256 signature for the JSON file.

   For example:

    tar -xvzf cte_compatibility_matrix.tgz
   

   CTE_Compatibility_Matrix_Cert_12-17-2020.pem

   cte_compatibility_matrix.json

   cte_compatibility_matrix.sign.sha256

3. Extract the Public Key from the X.509 Public Key Certificate. For example:

    openssl x509 -in CTE_Compatibility_Matrix_Cert_12-17-2020.pem -pubkey \
   -noout > cte_compatibility_matrix_public_key.pem
   

   The Public Key is in PEM format in the file cte_compatibility_matrix_public_key.pem.

4. Verify the SHA signature using the Public Key. For example:

    openssl dgst -sha256 -verify cte_compatibility_matrix_public_key.pem \
   -signature cte_compatibility_matrix.sign.sha256 cte_compatibility_matrix.json
   Verified OK