Installing network agents

The network agent is distributed as a Windows Installer package, Linux self-extracting installer, Linux native packages, and Docker container.

Installation package	Description	Auto-update
Windows Installer	The Windows Installer package utilizes a small bootstrap application that dynamically pulls the packages from Sectigo during installation. The bootstrap application and all Windows Installer package files (MSI) are digitally signed by Sectigo.	Yes
Linux self-extracting installer	The Linux self-extracting installer is a self-contained executable that has no external dependencies. The installer performs an integrity check before extracting.	Yes
Linux native packages (DEB/RPM)	The Linux native packages use Linux package managers such as APT/DNF to pull the packages from Sectigo during installation. The DEB metadata and RPM package are digitally signed by Sectigo using GPG.	No
Docker container	The Docker container offers a portable, self-contained deployment without manual installation.	No

Installation package

Description

Auto-update

Windows Installer

The Windows Installer package utilizes a small bootstrap application that dynamically pulls the packages from Sectigo during installation.

The bootstrap application and all Windows Installer package files (MSI) are digitally signed by Sectigo.

Yes

Linux self-extracting installer

The Linux self-extracting installer is a self-contained executable that has no external dependencies.

The installer performs an integrity check before extracting.

Yes

Linux native packages (DEB/RPM)

The Linux native packages use Linux package managers such as APT/DNF to pull the packages from Sectigo during installation.

The DEB metadata and RPM package are digitally signed by Sectigo using GPG.

Docker container

The Docker container offers a portable, self-contained deployment without manual installation.

Installation requirements

Network agents require a number of platform-dependent permissions in order to be installed and to perform SSL certificate discovery and automatic installation.

Windows
Linux
Docker

To install a network agent on Windows, the following requirements must be satisfied:

Local administrator rights
Windows Server:
- 2016 (Standard, Datacenter)
- 2019 (Standard, Datacenter)
- 2022 (Standard, Datacenter)
Hardware:
- CPU — 1.4GHz 64-bit (minimum)
- RAM — 2 GB (minimum)
Network access:

If your environment is configured to use non-default ports for remote communication or proxy, you must ensure that those ports are accessible.
- Outbound network access to https://dist.sectigo.com on TCP port 443
- Outbound network access to the appropriate SCM instance on TCP port 443:
  - https://cert-manager.com
  - https://hard.cert-manager.com
  - https://eu.cert-manager.com
- Certificate discovery: TCP port 443 or any port that serves up an SSL website
- Node discovery & auto installation: In addition to the general access requirements, specific ports are required based on the network agent’s connection type. The following are the default ports required for each connection type:
  - Local — N/A
  - Local (Legacy) — N/A
  - Remote (WinRM) — TCP port 5985
  - Remote (SSH) — TCP port 22
  - Remote (Legacy) — TCP ports 135 and 445
  - Remote (REST) — TCP port 443
- If applicable, your credential store must be accessible from the network agent machine.
(Optional) Credential store:
- Local credential store: No additional requirements
- HashiCorp Vault:
  - An active HashiCorp Vault instance
  - Access token or AppRole RoleId and SecretId with permission to read the required secrets
  - Remote server authentication credentials are stored in the HashiCorp Vault secrets engine
  - Secrets must be added as key/value pairs using the following keys:
    
    username — The username for the remote server.
    
    password — The password for the remote server. This cannot be included in a secret containing a private_key_path.
    
    private_key_path — The path to the private key file for the remote server. This cannot be included in a secret containing a password.
    
    pass_phrase — The passphrase for the private key file if one is configured.
- CyberArk Vault:
  - An active CyberArk Vault instance
  - A CyberArk Central Credential Provider instance connecting to the CyberArk Vault
  - (Certificate authentication only) A client private key and its certificate in .p12 format
  - An Application ID representing the network agent with permission to retrieve credentials
  - Remote server authentication credentials are stored in CyberArk Vault
- Delinea Secret Server:
  - An active Delinea Secret Server instance
  - A user account with permission to read required secrets
  - Remote server login credentials are stored in Delinea Secret Server

To install a network agent on Linux, the following requirements must be satisfied:

sudo permissions
Linux OS:
- CentOS Stream 8, Stream 9
- RHEL 8.x, 9.x
- Debian 11, 12
- Ubuntu 18.04, 20.04, 22.04
Hardware:
- CPU — 1.4GHz 64-bit (minimum)
- RAM — 2 GB (minimum)

Network access:

If your environment is configured to use non-default ports for remote communication or proxy, you must ensure that those ports are accessible. Additionally, the ephemeral port range for local connections may vary depending on your linux distribution.

Outbound network access to https://dist.sectigo.com on TCP port 443
Outbound network access to the appropriate SCM instance on TCP port 443:
- https://cert-manager.com
- https://hard.cert-manager.com
- https://eu.cert-manager.com
Certificate discovery: TCP port 443 or any port that serves up an SSL website
Node discovery & auto installation: In addition to the general access requirements, specific ports are required based on the network agent’s connection type. The following are the default ports required for each connection type:
- Local — N/A
- Remote (WinRM) — TCP port 5985
- Remote (SSH) — TCP port 22
- Remote (REST) — TCP port 443
If applicable, your credential store must be accessible from the network agent machine.

(Optional) Credential store:
- Local credential store: No additional requirements
- HashiCorp Vault:
  - An active HashiCorp Vault instance
  - Access token or AppRole RoleId and SecretId with permission to read the required secrets
  - Remote server authentication credentials are stored in the HashiCorp Vault secrets engine
- CyberArk Vault:
  - An active CyberArk Vault instance
  - A CyberArk Central Credential Provider instance connecting to the CyberArk Vault
  - (Certificate authentication only) A client private key and its certificate in .p12 format
  - An Application ID representing the network agent with permission to retrieve credentials
  - Remote server authentication credentials are stored in CyberArk Vault
- Delinea Secret Server:
  - An active Delinea Secret Server instance
  - A user account with permission to read required secrets
  - Remote server authentication credentials are stored in Delinea Secret Server

To run a network agent on Docker, the following requirement must be satisfied:

Docker engine installed
Hardware:
- CPU — 1.4GHz 64-bit (minimum)
- RAM — 2 GB (minimum)
Network access:

If your environment is configured to use non-default ports for remote communication or proxy, you must ensure that those ports are accessible.
- Outbound network access to https://dist.sectigo.com on TCP port 443
- Outbound network access to the appropriate SCM instance on TCP port 443:
  - https://cert-manager.com
  - https://hard.cert-manager.com
  - https://eu.cert-manager.com
- Certificate discovery: TCP port 443 or any port that serves up an SSL website
- If applicable, your credential store must be accessible from the network agent machine.
(Optional) Credential store:
- Local credential store: No additional requirements
- HashiCorp Vault:
  - An active HashiCorp Vault instance
  - Access token or AppRole RoleId and SecretId with permission to read the required secrets
  - Remote server authentication credentials are stored in the HashiCorp Vault secrets engine
- CyberArk Vault:
  - An active CyberArk Vault instance
  - A CyberArk Central Credential Provider instance connecting to the CyberArk Vault
  - (Certificate authentication only) A client private key and its certificate in .p12 format
  - An Application ID representing the network agent with permission to retrieve credentials
  - Remote server authentication credentials are stored in CyberArk Vault
- Delinea Secret Server:
  - An active Delinea Secret Server instance
  - A user account with permission to read required secrets
  - Remote server authentication credentials are stored in Delinea Secret Server

Add a network agent to SCM

Navigate to Integrations Network Agents and click the Add icon.
In the Add Network Agent dialog, provide a name to help identify the agent.
Select the organization and department under which to place the agent.
Click Next.
Copy the installation token for use during installation.
Download the agent with the Windows or Linux Self-Extracting installation package link.

Linux native installation packages (DEB/RPM) are downloaded through the CLI as part of the installation process.
Click Save.

The agent should now be listed on the Network Agents page with a status of Pending.

Install a network agent

Windows
Windows ( CLI )
Linux Self-Extracting
Linux APT ( DEB )
Linux DNF ( RPM )
Docker

Run the bootstrap application.

The bootstrap application will download the Windows Installer package files (MSI) from https://dist.sectigo.com as necessary. If you’re using an HTTP proxy, ensure that your OS proxy settings have been configured to allow access to https://dist.sectigo.com.

Read the EULA, select I agree to the license terms and conditions, and click Install.
Click Next.
Read the EULA, select I accept the terms in the License Agreement, and click Next.
Click Next, and paste the agent installation token.

If needed, you can retrieve the installation token from the Edit Network Agent dialog for your agent. This token is no longer available once the agent connects to SCM for the first time.
Click Next.

(Optional) Select Use Proxy and enter your proxy details based on the information provided in the following table.

Field	Description
Proxy PAC URL	The address of your proxy auto-config (PAC). This file contains your proxy configuration details and can be used instead of manually entering the values.
Proxy Host	The hostname or IP address of your proxy server.
Proxy Port	The port number used by your proxy server.
Proxy Domain	(NTLM proxy authentication only) The domain for accessing the proxy server.
Proxy User	The username for accessing the proxy server, if configured to use credentials.
Proxy Password	The password for accessing the proxy server, if configured to use credentials.

Field

Description

Proxy PAC URL

The address of your proxy auto-config (PAC).

This file contains your proxy configuration details and can be used instead of manually entering the values.

Proxy Host

The hostname or IP address of your proxy server.

Proxy Port

The port number used by your proxy server.

Proxy Domain

(NTLM proxy authentication only) The domain for accessing the proxy server.

Proxy User

The username for accessing the proxy server, if configured to use credentials.

Proxy Password

The password for accessing the proxy server, if configured to use credentials.

Click Next.
(Optional) Disable Enable Auto Update if you do not want the agent to automatically update to new versions.
Click Next, Install, Finish, and then Close.

The agent should now be listed on the Network Agents page with a status of Connected.

For Windows, the network agent logs are stored in %PROGRAMDATA%\Sectigo\Network Agent\logs and the configuration files are stored in %PROGRAMDATA%\Sectigo\Network Agent\conf.

A local credential store named sectigo-store is automatically created when you install a network agent. If you are interested in creating a different local store, or using a supported third-party credential store, see Configuring credential stores.

Open the Windows command prompt.

In the command line, navigate to the download location of the bootstrap application.

Modify the installation command as needed.

.\Sectigo_Network_Agent.exe /i /q PROPERTY_AUTOUPDATE=1 PROPERTY_TOKEN= PROPERTY_USE_PROXY= PROPERTY_PROXY_PAC_URL= PROPERTY_PROXY_HOST= PROPERTY_PROXY_PORT= PROPERTY_PROXY_USER= PROPERTY_PROXY_PASSWORD=

Options without an included value are ignored. The command options are outlined in the following table.

Option Description

Option	Description
`/i`	Initiates installation of the agent through the bootstrap application.
`/q`	Runs the installation in silent mode so no interaction is required.
`PROPERTY_AUTOUPDATE`	Indicates whether the agent should automatically update. The possible values are: `1` (Yes) Empty (No) If you do not include this command option, the default value of `1` (Yes) is applied.
`PROPERTY_TOKEN`	The mandatory installation token.
`PROPERTY_USE_PROXY`	Indicates whether you are using a proxy server. `1` (Yes) Empty (No)
`PROPERTY_PROXY_PAC_URL`	The address of your proxy auto-config (PAC). This file contains your proxy configuration details and can be used instead of specifying values for the `PROPERTY_PROXY_HOST`, `PROPERTY_PROXY_PORT`, `PROPERTY_PROXY_USER`, and `PROPERTY_PROXY_PASSWORD` options.
`PROPERTY_PROXY_HOST`	The hostname or IP address of your proxy server.
`PROPERTY_PROXY_PORT`	The port number used by your proxy server.
`PROPERTY_PROXY_DOMAIN`	(NTLM proxy authentication only) The domain for accessing the proxy server.
`PROPERTY_PROXY_USER`	The username for accessing the proxy server, if configured to use credentials.
`PROPERTY_PROXY_PASSWORD`	The password for accessing the proxy server, if configured to use credentials.

/i

Initiates installation of the agent through the bootstrap application.

/q

Runs the installation in silent mode so no interaction is required.

PROPERTY_AUTOUPDATE

Indicates whether the agent should automatically update.

The possible values are:

1 (Yes)
Empty (No)

If you do not include this command option, the default value of 1 (Yes) is applied.

PROPERTY_TOKEN

The mandatory installation token.

PROPERTY_USE_PROXY

Indicates whether you are using a proxy server.

1 (Yes)
Empty (No)

PROPERTY_PROXY_PAC_URL

The address of your proxy auto-config (PAC).

This file contains your proxy configuration details and can be used instead of specifying values for the PROPERTY_PROXY_HOST, PROPERTY_PROXY_PORT, PROPERTY_PROXY_USER, and PROPERTY_PROXY_PASSWORD options.

PROPERTY_PROXY_HOST

The hostname or IP address of your proxy server.

PROPERTY_PROXY_PORT

The port number used by your proxy server.

PROPERTY_PROXY_DOMAIN

(NTLM proxy authentication only) The domain for accessing the proxy server.

PROPERTY_PROXY_USER

The username for accessing the proxy server, if configured to use credentials.

PROPERTY_PROXY_PASSWORD

The password for accessing the proxy server, if configured to use credentials.

Run the modified installation command.

The agent should now be listed on the Network Agents page with a status of Connected.

For Windows, the network agent logs are stored in %PROGRAMDATA%\Sectigo\Network Agent\logs and the configuration files are stored in %PROGRAMDATA%\Sectigo\Network Agent\conf.

Give execute permission to the installer binary.
```
chmod +x sectigo-network-agent.bin
```
Run the installer.
```
sudo ./sectigo-network-agent.bin
```
Accept the EULA.
When prompted, paste the agent installation token.

(Optional) Enter your proxy details based on the information provided in the following table.

Parameter Description

Parameter	Description
`Proxy PAC URL`	The address of your proxy auto-config (PAC). This file contains your proxy configuration details and can be used instead of manually entering the values.
`Proxy Host`	The hostname or IP address of your proxy server.
`Proxy Port`	The port number used by your proxy server.
`Proxy Domain`	(NTLM proxy authentication only) The domain for accessing the proxy server.
`Proxy User`	The username for accessing the proxy server, if configured to use credentials.
`Proxy Password`	The password for accessing the proxy server, if configured to use credentials.

Proxy PAC URL

The address of your proxy auto-config (PAC).

This file contains your proxy configuration details and can be used instead of manually entering the values.

Proxy Host

The hostname or IP address of your proxy server.

Proxy Port

The port number used by your proxy server.

Proxy Domain

(NTLM proxy authentication only) The domain for accessing the proxy server.

Proxy User

The username for accessing the proxy server, if configured to use credentials.

Proxy Password

The password for accessing the proxy server, if configured to use credentials.

Select if auto update should be enabled. It is enabled by default.

The agent should now be listed on the Network Agents page with a status of Connected.

For Linux, the network agent logs are stored in /var/opt/sectigo-network-agent/logs and the configuration files are stored in /var/opt/sectigo-network-agent/conf.

Linux native packages do not support auto-update.

Add the GPG key to your system.

curl -fsSL https://dist.sectigo.com/scm/linux/apt-sign.gpg | sudo gpg --dearmor -o /usr/share/keyrings/sectigo-archive-keyring.gpg

Verify the GPG key.
```
gpg --show-keys /usr/share/keyrings/sectigo-archive-keyring.gpg
```
The GPG key fingerprint should match the following:

FCB9 DC04 DE50 2CBA 0F39 BFAF BFB4 716B 93A8 397B

Add the repository.

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/sectigo-archive-keyring.gpg] https://dist.sectigo.com/apt-$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/sectigo.list > /dev/null

Update the local package index.
```
sudo apt-get update
```

Install the network agent.

sudo apt-get install sectigo-network-agent

Configure the network agent.

sudo /opt/sectigo-network-agent/sectigona-config interactive

When prompted, paste the agent installation token.

(Optional) Enter your proxy details based on the information provided in the following table.

Parameter Description

Parameter	Description
`Proxy PAC URL`	The address of your proxy auto-config (PAC). This file contains your proxy configuration details and can be used instead of manually entering the values.
`Proxy Host`	The hostname or IP address of your proxy server.
`Proxy Port`	The port number used by your proxy server.
`Proxy Domain`	(NTLM proxy authentication only) The domain for accessing the proxy server.
`Proxy User`	The username for accessing the proxy server, if configured to use credentials.
`Proxy Password`	The password for accessing the proxy server, if configured to use credentials.

Proxy PAC URL

The address of your proxy auto-config (PAC).

This file contains your proxy configuration details and can be used instead of manually entering the values.

Proxy Host

The hostname or IP address of your proxy server.

Proxy Port

The port number used by your proxy server.

Proxy Domain

(NTLM proxy authentication only) The domain for accessing the proxy server.

Proxy User

The username for accessing the proxy server, if configured to use credentials.

Proxy Password

The password for accessing the proxy server, if configured to use credentials.

Start the network agent service.

SysVinit Linux:

sudo service sectigo-network-agent start

systemd Linux:

sudo systemctl start sectigo-network-agent

The agent should now be listed on the Network Agents page with a status of Connected.

For Linux, the network agent logs are stored in /var/opt/sectigo-network-agent/logs and the configuration files are stored in /var/opt/sectigo-network-agent/conf.

Linux native packages do not support auto-update.

Add the repository.

sudo dnf config-manager --add-repo https://dist.sectigo.com/scm/linux/sectigo-network-agent.repo

Install the network agent.
```
sudo dnf install sectigo-network-agent
```
When prompted to accept the GPG key, confirm the fingerprint matches the following:

0541 9789 e34e be6e e3d3 6096 5097 8649 30a7 d659

Configure the network agent.

sudo /opt/sectigo-network-agent/sectigona-config interactive

When prompted, paste the agent installation token.

(Optional) Enter your proxy details based on the information provided in the following table.

Parameter Description

Parameter	Description
`Proxy PAC URL`	The address of your proxy auto-config (PAC). This file contains your proxy configuration details and can be used instead of manually entering the values.
`Proxy Host`	The hostname or IP address of your proxy server.
`Proxy Port`	The port number used by your proxy server.
`Proxy Domain`	(NTLM proxy authentication only) The domain for accessing the proxy server.
`Proxy User`	The username for accessing the proxy server, if configured to use credentials.
`Proxy Password`	The password for accessing the proxy server, if configured to use credentials.

Proxy PAC URL

The address of your proxy auto-config (PAC).

This file contains your proxy configuration details and can be used instead of manually entering the values.

Proxy Host

The hostname or IP address of your proxy server.

Proxy Port

The port number used by your proxy server.

Proxy Domain

(NTLM proxy authentication only) The domain for accessing the proxy server.

Proxy User

The username for accessing the proxy server, if configured to use credentials.

Proxy Password

The password for accessing the proxy server, if configured to use credentials.

Start the network agent service.

SysVinit Linux:

sudo service sectigo-network-agent start

systemd Linux:

sudo systemctl start sectigo-network-agent

The agent should now be listed on the Network Agents page with a status of Connected.

For Linux, the network agent logs are stored in /var/opt/sectigo-network-agent/logs and the configuration files are stored in /var/opt/sectigo-network-agent/conf.

The Docker container does not support auto-update.

Create a directory on your Docker host machine for network agent data.
```
sudo mkdir /var/opt/network-agent-data
```

docker run --rm -v /var/opt/network-agent-data:/base sectigoinc/networkagent:latest register --token <token>

Run the network agent.

docker run -d --name sectigo-network-agent -v /var/opt/network-agent-data:/base sectigoinc/networkagent:latest

Configure SSL trusted issuers.

The agent uses the certificates file inside the container image, so host trust updates are not recognized and changes inside the container won’t persist. To use the host’s trusted CAs, mount the host’s certificates file and override the SSL_CERT_FILE environment variable.

For example, on Debian, use the following docker run command:
```
-v /etc/ssl/certs/ca-certificates.crt:/certs/ca-certificates.crt -e SSL_CERT_FILE=/certs/ca-certificates.crt
```
Configure the network agent.

Most agent configuration commands require direct communication with the agent service. Therefore, sectigona-config commands must be executed inside the running container. This command allows you to interact with the agent’s configuration directly, providing the ability to manage credential stores and other agent-specific settings.

For example, to list the available credential stores, execute the following command:
```
docker exec sectigo-network-agent sectigona-config credstore list
```

The agent should now be listed on the Network Agents page with a status of Connected.

Updating network agents

Update to a new agent version

Windows
Windows ( CLI )
Linux Self-Extracting
Linux DNF ( RPM )
Linux APT ( DEB )
Docker

Log in to SCM.
From the left-hand menu, select About.
Click the Download Network Agent icon and select Windows.
(Optional) If required, move the Sectigo_Network_Agent.exe file to the install location of the existing network agent.
Right-click Sectigo_Network_Agent.exe and click Install.

The package automatically recognizes that there’s an existing version of the network agent and initiates an update instead of a new install.
Read the EULA, select I agree to the license terms and conditions, and click Install.
Click Next.
Read the EULA, select I accept the terms in the License Agreement, and click Next.
(Optional) Specify an installation location.
Click Next, Install, and Close.
In SCM, navigate to the Network Agents page and verify that the agent is connected and showing the correct version.

Open the Windows command prompt.

In the command line, navigate to the download location of the bootstrap application.

Run the installer.
```
.\Sectigo_Network_Agent.exe
```
Read the EULA, select I agree to the license terms and conditions, and click Install.
Click Next.
Read the EULA, select I accept the terms in the License Agreement, and click Next.
Specify whether to keep or delete the existing files, and click Next.
(Optional) Specify an installation location.
Click Next, Install, and Close.
In SCM, navigate to the Network Agents page and verify that the agent is connected and showing the correct version.

Log in to SCM.
From the left-hand menu, select About.
Click the Download Network Agent icon and select Linux Self-Extracting.
(Optional) If required, move the sectigo-network-agent.bin file to the install location of the existing network agent.
Give execute permission to the installer binary.
```
chmod +x sectigo-network-agent.bin
```

Run the installer.

sudo ./sectigo-network-agent.bin -- --upgrade

In SCM, navigate to the Network Agents page and verify that the agent is connected and showing the correct version.

Run the update package.
```
sudo dnf upgrade sectigo-network-agent
```
In SCM, navigate to the Network Agents page and verify that the agent is connected and showing the correct version.

Run the update package.

sudo apt-get upgrade && sudo apt install --only-upgrade sectigo-network-agent

In SCM, navigate to the Network Agents page and verify that the agent is connected and showing the correct version.

Stop the Docker container.
```
docker stop sectigo-network-agent
```
Remove the old Docker container.
```
docker rm sectigo-network-agent
```

Pull the latest Docker container.

docker pull sectigoinc/networkagent:latest

Start the new Docker container.

docker run -d --name sectigo-network-agent -v /var/opt/network-agent-data:/base sectigoinc/networkagent:latest

In SCM, navigate to the Network Agents page and verify that the agent is connected and showing the correct version.

Update autoupdate settings

Autoupdate is only available on agent version 3.0 or later.

Windows ( CLI )
Linux Self-Extracting

In a command prompt, navigate to the network agent install location.
(Optional) View the current network agent configuration.
```
sectigona-config.exe autoupdate get
```
Update the network agent configuration.
Action Command
Disable autoupdate
sectigona-config.exe autoupdate disable
Enable autoupdate
sectigona-config.exe autoupdate enable

Action	Command
Disable `autoupdate`	`sectigona-config.exe autoupdate disable`
Enable `autoupdate`	`sectigona-config.exe autoupdate enable`

Restart the network agent service.

sc stop SectigoNetworkAgent

sc start SectigoNetworkAgent

Confirm the updated network agent configuration.
```
sectigona-config.exe autoupdate get
```

In a terminal, navigate to the network agent install location.
(Optional) View the current network agent configuration.
```
sudo sectigona-config autoupdate get
```
Update the network agent configuration.
Action Command
Disable autoupdate
sudo sectigona-config autoupdate disable
Enable autoupdate
sudo sectigona-config autoupdate enable

Action	Command
Disable `autoupdate`	`sudo sectigona-config autoupdate disable`
Enable `autoupdate`	`sudo sectigona-config autoupdate enable`

Restart the network agent service.

SysVinit Linux:

sudo service sectigo-network-agent restart

systemd Linux:

sudo systemctl restart sectigo-network-agent

Confirm the updated network agent configuration.
```
sudo sectigona-config autoupdate get
```

Update proxy server details

The supported proxy authentication schemes are the following:

Digest
NTLM (requires a domain to be provided)
Basic

Windows ( CLI )
Linux
Docker

To update the proxy server information for your existing network agent, do the following:

In a command prompt, navigate to the network agent install location.
(Optional) View the current network agent configuration.
```
sectigona-config.exe proxy get
```

Update the network agent configuration.

Action Command

Action	Command
Clear proxy settings	`sectigona-config.exe proxy set`
Set PAC URL	`sectigona-config.exe proxy set --pacurl <pac-url>`
Set proxy host and port without access credentials	`sectigona-config.exe proxy set --host <host> --port <port>`
Set proxy host and port with access credentials	`sectigona-config.exe proxy set --host <host> --port <port> --domain <domain> --user <username> --password <password>`

Clear proxy settings

sectigona-config.exe proxy set

Set PAC URL

sectigona-config.exe proxy set --pacurl <pac-url>

Set proxy host and port without access credentials

sectigona-config.exe proxy set --host <host> --port <port>

Set proxy host and port with access credentials

sectigona-config.exe proxy set --host <host> --port <port> --domain <domain> --user <username> --password <password>

The domain is only included if the proxy server uses NTLM authentication.

Restart the network agent service.

sc stop SectigoNetworkAgent

sc start SectigoNetworkAgent

Confirm the updated network agent configuration.
```
sectigona-config.exe proxy get
```

To update the proxy server information for your existing network agent, do the following:

In a terminal, navigate to the network agent install location.
(Optional) View the current network agent configuration.
```
sudo sectigona-config proxy get
```

Update the network agent configuration.

Action Command

Action	Command
Clear proxy settings	`sudo sectigona-config proxy set`
Set PAC URL	`sudo sectigona-config proxy set --pacurl <pac-url>`
Set proxy host and port without access credentials	`sudo sectigona-config proxy set --host <host> --port <port>`
Set proxy host and port with access credentials	`sudo sectigona-config proxy set --host <host> --port <port> --domain <domain> --user <username> --password <password>`

Clear proxy settings

sudo sectigona-config proxy set

Set PAC URL

sudo sectigona-config proxy set --pacurl <pac-url>

Set proxy host and port without access credentials

sudo sectigona-config proxy set --host <host> --port <port>

Set proxy host and port with access credentials

sudo sectigona-config proxy set --host <host> --port <port> --domain <domain> --user <username> --password <password>

The domain is only included if the proxy server uses NTLM authentication.

Restart the network agent service.

SysVinit Linux:

sudo service sectigo-network-agent restart

systemd Linux:

sudo systemctl restart sectigo-network-agent

Confirm the updated network agent configuration.
```
sudo sectigona-config proxy get
```

To update the proxy server information for your existing network agent, do the following:

(Optional) View the current network agent configuration.
```
docker exec sectigona-config proxy get
```

Update the network agent configuration.

Action Command

Action	Command
Clear proxy settings	`docker exec sectigona-config proxy set`
Set PAC URL	`docker exec sectigona-config proxy set --pacurl <pac-url>`
Set proxy host and port without access credentials	`docker exec sectigona-config proxy set --host <host> --port <port>`
Set proxy host and port with access credentials	`docker exec sectigona-config proxy set --host <host> --port <port> --domain <domain> --user <username> --password <password>`

Clear proxy settings

docker exec sectigona-config proxy set

Set PAC URL

docker exec sectigona-config proxy set --pacurl <pac-url>

Set proxy host and port without access credentials

docker exec sectigona-config proxy set --host <host> --port <port>

Set proxy host and port with access credentials

docker exec sectigona-config proxy set --host <host> --port <port> --domain <domain> --user <username> --password <password>

The domain is only included if the proxy server uses NTLM authentication.

Restart the docker container.

docker exec service sectigo-network-agent restart

Confirm the updated network agent configuration.
```
docker exec sectigona-config proxy get
```

Configuring credential stores

Sectigo network agents can be configured to utilize local or external credential stores for use when connecting to remote servers. Using a credential store enables you to securely store and manage credentials for remote servers without ever providing the credentials in SCM directly.

Sectigo network agents support the following credential stores:

Local
HashiCorp Vault
CyberArk Vault (via CyberArk Central Credential Provider)
Delinea Secret Server

Adding credential stores

Once a network agent has been installed, you can add a connection between the agent and a credential store.

Add a local credential store

Windows ( CLI )
Linux
Docker

A local credential store named sectigo-store is automatically created when you install a network agent. You can add additional credential stores as needed.

In a command prompt window, navigate to the network agent install location.
Modify the following command to include a --storename for your new local credential store.
```
sectigona-config.exe credstore add local --storename <store-name>
```
Run the modified installation command.

Once you have added a local credential store, you must add credentials before it can be used. For more information, see Adding credentials to a local credential store.

A local credential store named sectigo-store is automatically created when you install a network agent. You can add additional credential stores as needed.

In a terminal, navigate to the network agent install location.
Modify the following command to include a --storename for your new local credential store.
```
sudo sectigona-config credstore add local --storename <store-name>
```
Run the modified installation command.

Once you have added a local credential store, you must add credentials before it can be used. For more information, see Adding credentials to a local credential store.

A local credential store named sectigo-store is automatically created when you install a network agent. You can add additional credential stores as needed.

Modify the following command to include a --storename for your new local credential store.

docker exec sectigo-network-agent sectigona-config credstore add local --storename <store-name>

Run the modified installation command.

Once you have added a local credential store, you must add credentials before it can be used. For more information, see Adding credentials to a local credential store.

Add a HashiCorp Vault credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify one of the following commands based your preferred authentication method.

Token authentication:

sectigona-config.exe credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype Token --token <token> --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `Token` for this method.
`--token`	The token for `Token` authentication.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to Token for this method.

--token

The token for Token authentication.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

AppRoleSecret authentication:

sectigona-config.exe credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype AppRoleSecret --roleid <role-id> --secretid <secret-id> --appwrapped [Yes/No] --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `AppRoleSecret` for this method.
`--roleid`	The HashiCorp AppRole `RoleID`. Required when `--authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--secretid`	The HashiCorp AppRole `SecretID`. Required when `--authtype` is set to `AppRoleSecret`.
`--appwrapped`	Whether the AppRole `SecretId` is token wrapped or not. Can be `Yes` or `No`. Required when `authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to AppRoleSecret for this method.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretid

The HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleSecret.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Can be Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

AppRoleFile authentication:

sectigona-config.exe credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype AppRoleFile --roleid <role-id> --secretfile <secret-file> --appwrapped [Yes/No] --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `AppRoleFile` for this method.
`--roleid`	The HashiCorp AppRole `RoleID`. Required when `--authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--secretfile`	The path of a file containing the HashiCorp AppRole `SecretID`. Required when `--authtype` is set to `AppRoleFile`.
`--appwrapped`	Whether the AppRole `SecretId` is token wrapped or not. Can be `Yes` or `No`. Required when `authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to AppRoleFile for this method.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretfile

The path of a file containing the HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleFile.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Can be Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

Run the modified installation command.

Once you have added the credential store, you must add servers to the network agent and configure them to use the credential store. For more information, see Adding servers to the network agent.

In a terminal, navigate to the network agent install location.

Modify one of the following commands based your preferred authentication method.

Token authentication:

sudo sectigona-config credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype Token --token <token> --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `Token` for this method.
`--token`	The token for `Token` authentication.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to Token for this method.

--token

The token for Token authentication.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

AppRoleSecret authentication:

sudo sectigona-config credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype AppRoleSecret --roleid <role-id> --secretid <secret-id> --appwrapped [Yes/No] --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `AppRoleSecret` for this method.
`--roleid`	The HashiCorp AppRole `RoleID`. Required when `--authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--secretid`	The HashiCorp AppRole `SecretID`. Required when `--authtype` is set to `AppRoleSecret`.
`--appwrapped`	Whether the AppRole `SecretId` is token wrapped or not. Can be `Yes` or `No`. Required when `authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to AppRoleSecret for this method.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretid

The HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleSecret.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Can be Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

Modify one of the following commands based your preferred authentication method.

Token authentication:

docker exec sectigo-network-agent sectigona-config credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype Token --token <token> --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `Token` for this method.
`--token`	The token for `Token` authentication.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to Token for this method.

--token

The token for Token authentication.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

AppRoleSecret authentication:

docker exec sectigo-network-agent credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype AppRoleSecret --roleid <role-id> --secretid <secret-id> --appwrapped [Yes/No] --rootpath <root-path> --verify <path-of-secret>

Option Description

Option	Description
`--storename`	The name of your HashiCorp Vault credential store.
`--vaulturl`	The URL of your HashiCorp Vault.
`--authtype`	The authentication type. Set this to `AppRoleSecret` for this method.
`--roleid`	The HashiCorp AppRole `RoleID`. Required when `--authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--secretid`	The HashiCorp AppRole `SecretID`. Required when `--authtype` is set to `AppRoleSecret`.
`--appwrapped`	Whether the AppRole `SecretId` is token wrapped or not. Can be `Yes` or `No`. Required when `authtype` is set to `AppRoleSecret` or `AppRoleFile`.
`--rootpath`	The root path for the secret in the credential store.
`--verify`	(Optional) The path of the secret used to verify its existence.

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to AppRoleSecret for this method.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretid

The HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleSecret.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Can be Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

AppRoleFile authentication:

docker exec sectigo-network-agent credstore add hashicorp --storename <store-name> --vaulturl <vault-url> --authtype AppRoleFile --roleid <role-id> --secretfile <secret-file> --appwrapped [Yes/No] --rootpath <root-path> --verify <path-of-secret>

Option Description

--storename

The name of your HashiCorp Vault credential store.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to AppRoleFile for this method.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretfile

The path of a file containing the HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleFile.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Options are Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--rootpath

The root path for the secret in the credential store.

--verify

(Optional) The path of the secret used to verify its existence.

Run the modified installation command.

Once you have added the credential store, you must add servers to the network agent and configure them to use the credential store. For more information, see Adding servers to the network agent.

Add a CyberArk Vault credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify one of the following commands based your preferred authentication method.

Machine address authentication:

sectigona-config.exe credstore add cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--verify

(Optional) The query string of the secret used to verify its existence.

Certificate authentication:

sectigona-config.exe credstore add cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url>  --authcert <authcert-file-path> --certpass <password-of-authcert> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--authcert

The file path for the authentication certificate.

--certpass

The password of the authentication certificate.

--verify

(Optional) The query string of the secret used to verify its existence.

Run the modified installation command.

Once you have added the credential store, you must add servers to the network agent and configure them to use the credential store. For more information, see Adding servers to the network agent.

In a terminal, navigate to the network agent install location.

Modify one of the following commands based your preferred authentication method.

Machine address authentication:

sudo sectigona-config credstore add cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--verify

(Optional) The query string of the secret used to verify its existence.

Certificate authentication:

sudo sectigona-config credstore add cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url>  --authcert <authcert-file-path> --certpass <password-of-authcert> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--authcert

The file path for the authentication certificate.

--certpass

The password of the authentication certificate.

--verify

(Optional) The query string of the secret used to verify its existence.

Run the modified installation command.

Once you have added the credential store, you must add servers to the network agent and configure them to use the credential store. For more information, see Adding servers to the network agent.

Modify one of the following commands based your preferred authentication method.

Machine address authentication:

docker exec sectigo-network-agent credstore add cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--verify

(Optional) The query string of the secret used to verify its existence.

Certificate authentication:

docker exec sectigo-network-agent credstore add cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url>  --authcert <authcert-file-path> --certpass <password-of-authcert> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--authcert

The file path for the authentication certificate.

--certpass

The password of the authentication certificate.

--verify

(Optional) The query string of the secret used to verify its existence.

Run the modified installation command.

Once you have added the credential store, you must add servers to the network agent and configure them to use the credential store. For more information, see Adding servers to the network agent.

Add a Delinea Secret Server credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify the add command as needed.

sectigona-config credstore add delinea-secret-server --storename <store-name> --url <server-url> --username <username> --password <password>  --verify <secret-id>

Option Description

--storename

The name of your Delinea Secret Server credential store.

--url

The URL of your Delinea Secret Server.

--username

The username for the user account used by the network agent to authenticate to the Secret Server.

--password

The password for the user account used by the network agent to authenticate to the Secret Server.

--verify

(Optional) The secret id used to verify its existence.

In a terminal, navigate to the network agent install location.

Modify the add command as needed.

sudo sectigona-config credstore add delinea-secret-server --storename <store-name> --url <server-url> --username <username> --password <password>  --verify <secret-id>

Option Description

--storename

The name of your Delinea Secret Server credential store.

--url

The URL of your Delinea Secret Server.

--username

The username for the user account used by the network agent to authenticate to the Secret Server.

--password

The password for the user account used by the network agent to authenticate to the Secret Server.

--verify

(Optional) The secret id used to verify its existence.

Modify the add command as needed.

docker exec sectigo-network-agent credstore add delinea-secret-server --storename <store-name> --url <server-url> --username <username> --password <password>  --verify <secret-id>

Option Description

--storename

The name of your Delinea Secret Server credential store.

--url

The URL of your Delinea Secret Server.

--username

The username for the user account used by the network agent to authenticate to the Secret Server.

--password

The password for the user account used by the network agent to authenticate to the Secret Server.

--verify

(Optional) The secret id used to verify its existence.

Managing local credential stores

Unlike external credential stores, local credential stores are managed entirely through the network agent command line tool. Once a local store is created, you can add, update, or remove credentials as needed.

Add credentials to a local credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify the following command to include the mandatory --storename, --id, and --username with the appropriate accompanying credential option(s).

sectigona-config.exe credstore credentials add --storename <store-name> --id <id> --username <username> --password <password> --privatekeypath <private-key-path> --passphrase <passphrase>

Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.

--username

The username for the credential.

--password

The password for the credential.

Required if --privatekeypath is not provided.

--privatekeypath

The path to the private key for the credential.

Required if --password is not provided.

--passphrase

The passphrase for the private key.

Required if --privatekeypath is provided and configured with a passphrase.

Run the modified command.

In a terminal, navigate to the network agent install location.

Modify the following command to include the mandatory --storename, --id, and --username with the appropriate accompanying credential option(s).

sudo sectigona-config credstore credentials add --storename <store-name> --id <id> --username <username> --password <password> --privatekeypath <private-key-path> --passphrase <passphrase>

Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.

--username

The username for the credential.

--password

The password for the credential.

Required if --privatekeypath is not provided.

--privatekeypath

The path to the private key for the credential.

Required if --password is not provided.

--passphrase

The passphrase for the private key.

Required if --privatekeypath is provided and configured with a passphrase.

Run the modified command.

In a terminal, modify the following command to include the mandatory --storename, --id, and --username with the appropriate accompanying credential option(s).

docker exec sectigo-network-agent credstore credentials add --storename <store-name> --id <id> --username <username> --password <password> --privatekeypath <private-key-path> --passphrase <passphrase>

Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.

--username

The username for the credential.

--password

The password for the credential.

Required if --privatekeypath is not provided.

--privatekeypath

The path to the private key for the credential.

Required if --password is not provided.

--passphrase

The passphrase for the private key.

Required if --privatekeypath is provided and configured with a passphrase.

Run the modified command.

Update credentials in a local credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify the following command to include the mandatory --storename, --id, and the additional options you want to update.

sectigona-config.exe credstore credentials update --storename <store-name> --id <id> --username <username> --password <password> --privatekeypath <private-key-path> --passphrase <passphrase>

Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.

--username

The username for the credential.

--password

The password for the credential.

--privatekeypath

The path to the private key for the credential.

--passphrase

The passphrase for the private key.

Required if --privatekeypath is provided and configured with a passphrase that changed or hasn’t been provided.

Run the modified command.

In a terminal, navigate to the network agent install location.

Modify the following command to include the mandatory --storename, --id, and the additional options you want to update.

sudo sectigona-config credstore credentials update --storename <store-name> --id <id> --username <username> --password <password> --privatekeypath <private-key-path> --passphrase <passphrase>

Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.

--username

The username for the credential.

--password

The password for the credential.

--privatekeypath

The path to the private key for the credential.

--passphrase

The passphrase for the private key.

Required if --privatekeypath is provided and configured with a passphrase that changed or hasn’t been provided.

Run the modified command.

Modify the following command to include the mandatory --storename, --id, and the additional options you want to update.

docker exec sectigo-network-agent credstore credentials update --storename <store-name> --id <id> --username <username> --password <password> --privatekeypath <private-key-path> --passphrase <passphrase>

Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.

--username

The username for the credential.

--password

The password for the credential.

--privatekeypath

The path to the private key for the credential.

--passphrase

The passphrase for the private key.

Required if --privatekeypath is provided and configured with a passphrase that changed or hasn’t been provided.

Run the modified command.

Remove credentials from a local credential store

Windows ( CLI )
Linux
Docker

In SCM, verify that the credentials you want to remove are not in use by an added server.
In a command prompt window, navigate to the network agent install location.
Modify the following command to include the --storename and --id of the credentials you want to remove.
```
sectigona-config.exe credstore credentials remove --storename <store-name> --id <id>
```
Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.
Run the modified command

In SCM, verify that the credentials you want to remove are not in use by an added server.
In a terminal, navigate to the network agent install location.
Modify the following command to include the --storename and --id of the credentials you want to remove.
```
sudo sectigona-config credstore credentials remove --storename <store-name> --id <id>
```
Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.
Run the modified command

In SCM, verify that the credentials you want to remove are not in use by an added server.
Modify the following command to include the --storename and --id of the credentials you want to remove.
```
docker exec sectigo-network-agent credstore credentials remove --storename <store-name> --id <id>
```
Option Description

--storename

The name of your local credential store.

--id

The ID of the credential.
Run the modified command

Updating credential stores

If required, you can update the connection between a network agent and an existing external credential store.

Update a HashiCorp Vault credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify the following command to include the mandatory --storename and any options you want to update.

sectigona-config.exe credstore update hashicorp --storename <store-name> --vaulturl <vault-url> --authtype <Token/AppRoleSecret/AppRoleFile> --token <token> --rootpath <root-path> --roleid <role-id> --secretid <secret-id> --secretfile <secret-file> --appwrapped <Yes/No> --verify <path-of-secret>

Option Description

--storename

The name of your HashiCorp Vault credential store.

Required for all authtype options.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to Token, AppRoleSecret, or AppRoleFile for the respective method.

If you are updating the authtype and the new type requires different parameters, you must provide the new parameters.

If you are updating the authtype and it reuses required parameters from the previous type that have not changed, you do not need to provide the parameters again.

--token

The token for Token authentication.

Required when authtype is set to Token.

--rootpath

The root path for the secret in the credential store.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretid

The HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleSecret.

--secretfile

The path of a file containing the HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleFile.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Can be Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--verify

(Optional) The path of the secret used to verify its existence.

Required for all authtype options.

Run the modified installation command.

In a terminal, navigate to the network agent install location.

Modify the following command to include the mandatory --storename and any options you want to update.

sudo sectigona-config credstore update hashicorp --storename <store-name> --vaulturl <vault-url> --authtype <Token/AppRoleSecret/AppRoleFile> --token <token> --rootpath <root-path> --roleid <role-id> --secretid <secret-id> --secretfile <secret-file> --appwrapped <Yes/No> --verify <path-of-secret>

Option Description

--storename

The name of your HashiCorp Vault credential store.

Required for all authtype options.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to Token, AppRoleSecret, or AppRoleFile for the respective method.

If you are updating the authtype and the new type requires different parameters, you must provide the new parameters.

If you are updating the authtype and it reuses required parameters from the previous type that have not changed, you do not need to provide the parameters again.

--token

The token for Token authentication.

Required when authtype is set to Token.

--rootpath

The root path for the secret in the credential store.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretid

The HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleSecret.

--secretfile

The path of a file containing the HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleFile.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Can be Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--verify

(Optional) The path of the secret used to verify its existence.

Required for all authtype options.

Run the modified installation command.

Modify the following command to include the mandatory --storename and any options you want to update.

docker exec sectigo-network-agent credstore update hashicorp --storename <store-name> --vaulturl <vault-url> --authtype <Token/AppRoleSecret/AppRoleFile> --token <token> --rootpath <root-path> --roleid <role-id> --secretid <secret-id> --secretfile <secret-file> --appwrapped <Yes/No> --verify <path-of-secret>

Option Description

--storename

The name of your HashiCorp Vault credential store.

Required for all authtype options.

--vaulturl

The URL of your HashiCorp Vault.

--authtype

The authentication type.

Set this to Token, AppRoleSecret, or AppRoleFile for the respective method.

If you are updating the authtype and the new type requires different parameters, you must provide the new parameters.

If you are updating the authtype and it reuses required parameters from the previous type that have not changed, you do not need to provide the parameters again.

--token

The token for Token authentication.

Required when authtype is set to Token.

--rootpath

The root path for the secret in the credential store.

--roleid

The HashiCorp AppRole RoleID.

Required when --authtype is set to AppRoleSecret or AppRoleFile.

--secretid

The HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleSecret.

--secretfile

The path of a file containing the HashiCorp AppRole SecretID.

Required when --authtype is set to AppRoleFile.

--appwrapped

Whether the AppRole SecretId is token wrapped or not.

Options are Yes or No.

Required when authtype is set to AppRoleSecret or AppRoleFile.

--verify

(Optional) The path of the secret used to verify its existence.

Required for all authtype options.

Run the modified installation command.

Update a CyberArk Vault credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify the following command to include the mandatory --storename and any options you want to update.

sectigona-config.exe credstore update cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url>  --authcert <authcert-file-path> --certpass <password-of-authcert> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--authcert

The file path for the authentication certificate.

--certpass

The password of the authentication certificate.

Required when authcert is used.

--verify

(Optional) The query string of the secret used to verify its existence.

Run the modified installation command.

In a terminal, navigate to the network agent install location.

Modify the following command to include the mandatory --storename and any options you want to update.

sudo sectigona-config credstore update cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url>  --authcert <authcert-file-path> --certpass <password-of-authcert> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--authcert

The file path for the authentication certificate.

--certpass

The password of the authentication certificate.

Required when authcert is used.

--verify

(Optional) The query string of the secret used to verify its existence.

Run the modified installation command.

Modify the following command to include the mandatory --storename and any options you want to update.

docker exec sectigo-network-agent credstore update cyberark --storename <store-name> --appid <app-id> --ccpurl <ccp-url>  --authcert <authcert-file-path> --certpass <password-of-authcert> --verify <query-string>

Option Description

--storename

The name of your CyberArk credential store.

--appid

The application ID for CyberArk authentication.

--ccpurl

The URL of your CyberArk Central Credential Provider.

--authcert

The file path for the authentication certificate.

--certpass

The password of the authentication certificate.

Required when authcert is used.

--verify

(Optional) The query string of the secret used to verify its existence.

Run the modified installation command.

Update a Delinea Secret Server credential store

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.

Modify the following command to include the mandatory --storename and any options you want to update.

sectigona-config credstore update delinea-secret-server -storename <store-name> --url <server-url> --username <username> --password <password>  --verify <secret-id>

Option Description

--storename

The name of your Delinea Secret Server credential store.

--url

The URL of your Delinea Secret Server.

--username

The username for the user account used by the network agent to authenticate to the Secret Server.

--password

The password for the user account used by the network agent to authenticate to the Secret Server.

--verify

(Optional) The secret id used to verify its existence.

Run the modified installation command.

In a terminal, navigate to the network agent install location.

Modify the following command to include the mandatory --storename and any options you want to update.

sudo sectigona-config credstore update delinea-secret-server -storename <store-name> --url <server-url> --username <username> --password <password>  --verify <secret-id>

Option Description

--storename

The name of your Delinea Secret Server credential store.

--url

The URL of your Delinea Secret Server.

--username

The username for the user account used by the network agent to authenticate to the Secret Server.

--password

The password for the user account used by the network agent to authenticate to the Secret Server.

--verify

(Optional) The secret id used to verify its existence.

Run the modified installation command.

Modify the following command to include the mandatory --storename and any options you want to update.

docker exec sectigo-network-agent credstore update delinea-secret-server -storename <store-name> --url <server-url> --username <username> --password <password>  --verify <secret-id>

Option Description

--storename

The name of your Delinea Secret Server credential store.

--url

The URL of your Delinea Secret Server.

--username

The username for the user account used by the network agent to authenticate to the Secret Server.

--password

The password for the user account used by the network agent to authenticate to the Secret Server.

--verify

(Optional) The secret id used to verify its existence.

Run the modified installation command.

Viewing credential stores and credentials

View credential stores

Windows ( CLI )
Linux
Docker

In a command prompt window, navigate to the network agent install location.
View all credential stores associated with the network agent.
```
sectigona-config.exe credstore list
```

In a terminal, navigate to the network agent install location.
View all credential stores associated with the network agent.
```
sudo sectigona-config credstore list
```

View all credential stores associated with the network agent.
```
docker exec sectigo-network-agent credstore list
```

View credentials

Windows ( CLI )
Linux
Docker

In a terminal, navigate to the network agent install location.

View credentials in a specific credential store.

List all credentials from a local credential store.

sectigona-config.exe credstore credentials list --storename <store-name>

Get specific credentials from a credential store.

sectigona-config.exe credstore credentials get --storename <store-name> --id <id>

Option Description

--storename

The name of the credential store.

--id

The unique identifier of the credential.

CyberArk Vault — The ID is a set of key value pairs, separated by semicolons, that would typically go in a query parameter string used to retrieve a specific credential from the CyberArk Central Credential Provider.

The ID format should be similar to the following:
```
--id "<param1>=<value>;<param2>=<value>;..."
```
HashiCorp Vault — The ID is the path of the required secret in HashiCorp vault. This path is relative to the --rootpath specified when adding the credential store.
Delinea Secret Server — The ID is the unique Secret ID of the Delinea secret.
Local credential store — The ID is the unique identifying string of the credential in the local credential store.

In a terminal, navigate to the network agent install location.

View credentials in a specific credential store.

List all credentials in a specific local store.

sudo sectigona-config credstore credentials list --storename <store-name>

Get specific credentials from a credential store.

sudo sectigona-config credstore credentials get --storename <store-name> --id <id>

Option Description

--storename

The name of the credential store.

--id

The unique identifier of the credential.

CyberArk Vault — The ID is a set of key value pairs, separated by semicolons, that would typically go in a query parameter string used to retrieve a specific credential from the CyberArk Central Credential Provider.

The ID format should be similar to the following:
```
--id "<param1>=<value>;<param2>=<value>;..."
```
HashiCorp Vault — The ID is the path of the required secret in HashiCorp vault. This path is relative to the --rootpath specified when adding the credential store.
Delinea Secret Server — The ID is the unique Secret ID of the Delinea secret.
Local credential store — The ID is the unique identifying string of the credential in the local credential store.

View credentials in a specific credential store.

List all credentials in a specific local store.

docker exec sectigo-network-agent credstore credentials list --storename <store-name>

Get specific credentials from a credential store.

docker exec sectigo-network-agent credstore credentials get --storename <store-name> --id <id>

Option Description

--storename

The name of the credential store.

--id

The unique identifier of the credential.

CyberArk Vault — The ID is a set of key value pairs, separated by semicolons, that would typically go in a query parameter string used to retrieve a specific credential from the CyberArk Central Credential Provider.

The ID format should be similar to the following:
```
--id "<param1>=<value>;<param2>=<value>;..."
```
HashiCorp Vault — The ID is the path of the required secret in HashiCorp vault. This path is relative to the --rootpath specified when adding the credential store.
Delinea Secret Server — The ID is the unique Secret ID of the Delinea secret.
Local credential store — The ID is the unique identifying string of the credential in the local credential store.

Remove a credential store

Windows ( CLI )
Linux
Docker

In SCM, verify that the credential store you want to remove is not in use by an added server.
In a command prompt window, navigate to the network agent install location.
Modify the following command to include the mandatory --storename of the credential store you want to remove.
```
sectigona-config.exe credstore remove -storename <name>
```
The default local credential store sectigo-store cannot be removed.
Run the modified installation command.

In SCM, verify that the credential store you want to remove is not in use by an added server.
In a terminal, navigate to the network agent install location.
Modify the following command to include the mandatory --storename of the credential store you want to remove.
```
sudo sectigona-config credstore remove -storename <name>
```
The default local credential store sectigo-store cannot be removed.
Run the modified installation command.

In SCM, verify that the credential store you want to remove is not in use by an added server.
Modify the following command to include the mandatory --storename of the credential store you want to remove.
```
docker exec sectigo-network-agent credstore remove -storename <name>
```
The default local credential store sectigo-store cannot be removed.
Run the modified installation command.

Uninstall a network agent

Windows
Linux Self-Extracting
Linux APT ( DEB )
Linux DNF ( RPM )

Navigate to Settings Apps & features.
Search for Sectigo Network Agent.
Select the Sectigo Network Agent and click Uninstall.
(Optional) Delete the files and logs associated with the network agent.
1. Navigate to C:\ProgramData\Sectigo.
2. Delete the Network Agent folder.
  
  This cannot be undone. Only delete this folder if you want to completely remove all files and logs related to the agent.
In SCM, navigate to Integrations Network Agents.
Select the agent you want to delete.
Click the Delete icon.
Click Delete again.

Stop the network agent service.
```
sudo service sectigo-network-agent stop
```
Navigate to the /etc/init.d directory.
Delete the sectigo-network-agent directory.
Delete the network agent installation files.
1. Navigate to the /opt directory.
2. Delete the sectigo-network-agent directory.
(Optional) Delete the files and logs associated with the network agent.
1. Navigate to the /var/opt directory.
2. Delete the sectigo-network-agent directory.
  
  This cannot be undone. Only delete this directory if you want to completely remove all files and logs related to the agent.
In SCM, navigate to Integrations Network Agents.
Select the agent you want to delete.
Click Delete.
Click Delete again.

Remove the network agent.
```
sudo apt remove sectigo-network-agent
```

Remove the JRE.

sudo apt remove sectigo-network-agent-jre

(Optional) Delete the files and logs associated with the network agent.
1. Navigate to the /var/opt directory.
2. Delete the sectigo-network-agent directory.
  
  This cannot be undone. Only delete this directory if you want to completely remove all files and logs related to the agent.
In SCM, navigate to Integrations Network Agents.
Select the agent you want to delete.
Click Delete.
Click Delete again.

Remove the network agent.
```
sudo dnf remove sectigo-network-agent
```

Remove the JRE.

sudo dnf remove sectigo-network-agent-jre

(Optional) Delete the files and logs associated with the network agent.
1. Navigate to the /var/opt directory.
2. Delete the sectigo-network-agent directory.
  
  This cannot be undone. Only delete this directory if you want to completely remove all files and logs related to the agent.
In SCM, navigate to Integrations Network Agents.
Select the agent you want to delete.
Click Delete.
Click Delete again.

Network agent service commands

Windows
Linux ( SysVinit )
Linux ( systemd )

Command Description

Start

Start a network agent:

sc start SectigoNetworkAgent

Stop

Stop a network agent:

sc stop SectigoNetworkAgent

Query

Query the status of a network agent:

sc query SectigoNetworkAgent

Command Description

Start

Start a network agent:

sudo service sectigo-network-agent start

Stop

Stop a network agent:

sudo service sectigo-network-agent stop

Restart

Restart a network agent:

sudo service sectigo-network-agent restart

Status

Query the status of a network agent:

sudo service sectigo-network-agent status

Command Description

Start

Start a network agent:

sudo systemctl start sectigo-network-agent

Stop

Stop a network agent:

sudo systemctl stop sectigo-network-agent

Restart

Restart a network agent:

sudo systemctl restart sectigo-network-agent

Status

Query the status of a network agent:

sudo systemctl status sectigo-network-agent