Validating CM and CTE with a Local CA Certificate

To ensure that registration by the CTE agent is serviced only by the expected key manager, you can provide a copy of the root CA certificate that will be used to authenticate the TLS communications with the key manager, during the registration process.

Prerequisite

Make sure that you have previously created the client in CipherTrust Manager.

Using a Local CA Certificate

1. Extract the root CA certificate from the CipherTrust Manager.

   1. Log on to CipherTrust Manager as an administrator.

   2. In the left navigation pane, click CA > Local. The list of available CAs displays.

   3. Click the ellipsis icon corresponding to the CA.

   4. Click Download to download the CA.

   5. Copy the certificate to a directory on the agent system.

2. To install the root CA certificate into the CTE client, add it to the registration command line:

   Note

   You must have administrator privilege to complete this step.

   C:\Windows\system32> C:\Program Files\Vormetric\DataSecurityExpert\agent\shared\bin\register_host.exe -silent -log= -vmd -agent= -token= -cafile=

   Example

   C:\Program Files\Vormetric\DataSecurityExpert\agent\shared\bin\register_host.exe -silent -log=c:\vte_reg_log.txt -vmd 10.171.36.175 -agent=ani-vm-217-35190.sjcicd.com -token=mMEz3Y6Ob9D4L7QuvK5SOmhulRm8DYI8odV5j3OdvuHqk6LhZqE0FeIZHILYTmDiE9 -cafile=C:\tmp\Austin175.pem
   

3. Confirm in CipherTrust Manager that the client is registered and healthy.