Managing orchestration gateways

Update an orchestration gateway

  • Windows

  • Windows ( CLI )

  • Linux APT ( DEB )

  • Linux DNF ( RPM )

  • Docker

  1. Log in to SCM.

  2. From the left-hand menu, select About.

  3. In the Orchestration Gateway Version row, click the Download Orchestration Gateway icon, and select Windows.

  4. Right-click SectigoOG.msi and click Install.

    The package automatically recognizes that there’s an existing version of the orchestration gateway and initiates an update instead of a new install.

  5. Read the EULA, select I accept the terms in the License Agreement, and click Install.

  6. Click Next.

  7. Click Next, Install, and Close.

  8. In SCM, navigate to the Orchestration Gateways page and verify that the gateway is connected.

  1. Log in to SCM.

  2. From the left-hand menu, select About.

  3. In the Orchestration Gateway Version row, click the Download Orchestration Gateway icon, and select Windows.

  1. In the command line, navigate to the download location of the SectigoOG.msi file.

  2. Run the installation command.

    msiexec /i /q SectigoOG.msi

    The package automatically recognizes that there’s an existing version of the orchestration gateway and initiates an update instead of a new install.

  3. In SCM, navigate to the Orchestration Gateways page and verify that the gateway is connected.

Linux native packages do not support auto-update.

  1. Update the local package index.

    sudo apt-get update

  2. Update the orchestration gateway.

    sudo apt install --only-upgrade sectigo-orchestration-gateway

  3. In SCM, navigate to the Orchestration Gateways page and verify that the gateway is connected.

Linux native packages do not support auto-update.

  1. Update the orchestration gateway.

    dnf update sectigo-orchestration-gateway

  2. In SCM, navigate to the Orchestration Gateways page and verify that the gateway is connected.

  1. Stop the Docker container.

    docker stop sog

  2. Remove the old Docker container.

    docker rm sog

  3. Pull the latest Docker container.

    docker pull sectigoinc/sog:latest

  4. Start the new Docker container.

    docker run -d --name sog -v /var/opt/sog_data:/base sectigoinc/sog:latest

  5. In SCM, navigate to the Orchestration Gateways page and verify that the agent is connected and showing the correct version.

Managing keystores

Add a keystore

  • SCM ( UI )

  • Windows

  • Linux

  • Docker

  1. Navigate to Integrations  Orchestration Gateways and select your orchestration gateway.

  2. Click Keystores and then click the Add icon.

  3. Select a keystore type.

  4. (Optional) Enter comments about the keystore.

  5. Click Next.

  6. Enter a keystore name and password.

  7. Click Save.

The new keystore should now be listed on the Keystores page.

  1. Open the Windows command line.

  2. Navigate to the orchestration gateway installation directory.

  3. (Optional) To list keystores, run the following command.

    sectigo-og.exe keystore list

  4. Run the following command to add a keystore. Replace <type> with one of the following keystore types:

    • jks — for a JKS keystore

    • p12 — for a PKCS#12 keystore

      sectigo-og.exe keystore add <type> --name <name> --password <password>

  5. Navigate to SCM Integrations  Orchestration Gateways and select your orchestration gateway.

  6. Click Sync Endpoints and you will see a successful synchronization message.

  7. Click Keystores and the new keystore should be listed.

  1. Navigate to the orchestration gateway installation directory.

    cd /opt/sectigo-orchestration-gateway/bin

  2. (Optional) To list keystores, run the following command.

    ./sectigo-og keystore list

  3. Run the following command to add a keystore. Replace <type> with one of the following keystore types:

    • jks — for a JKS keystore

    • p12 — for a PKCS#12 keystore

      ./sectigo-og keystore add <type> --name <name> --password <password>

  4. Navigate to SCM Integrations  Orchestration Gateways and select your orchestration gateway.

  5. Click Sync Modules and you will see a successful synchronization message.

  6. Click Keystores and the new keystore should be listed.

    The keystore file is stored in /opt/sectigo-orchestration-gateway/config/.

  1. (Optional) To list keystores and add a keystore, run the following command.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og keystore list

  2. Run the following command to add a keystore. Replace <type> with one of the following keystore types:

    • jks — for a JKS keystore

    • p12 — for a PKCS#12 keystore

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og keystore add <type> --name <name> --password <password>

  3. Navigate to SCM Integrations  Orchestration Gateways and select your orchestration gateway.

  4. Click Sync Modules and you will see a successful synchronization message.

  5. Click Keystores and the new keystore should be listed.

Delegate a keystore

  1. Navigate to Integrations  Orchestration Gateways and select your orchestration gateway.

  2. Click Keystores and select the keystore you want to delegate.

  3. Click Delegate.

  4. In the Delegate keystore dialog, choose one of the following delegation modes:

    • General — Makes the keystore available to all existing organizations.

    • Customized — Allows you to select the organizations and departments that can use the keystore.

  5. If you selected Customized, select the required organizations or departments from the list.

    Expand an organization to view and select its child departments, if applicable.

  6. Click Save.

Edit a keystore

  1. Navigate to SCM Integrations  Orchestration Gateways and select your orchestration gateway.

  2. Click Keystores and select the keystore you want to edit.

  3. Click Edit and update the Password and Comments.

  4. Click Save.

Remove a keystore

  1. Navigate to SCM Integrations  Orchestration Gateways and select your orchestration gateway.

  2. Click Keystores and select the keystore you want to remove.

  3. Click Remove and then click Delete in the confirmation dialog.

Delegate an orchestration gateway

  1. Navigate to Integrations  Orchestration Gateways.

  2. Select the orchestration gateway you want to delegate.

  3. Click Delegate.

  4. In the Delegate Orchestration Gateway dialog, choose one of the following delegation modes:

    • General — Makes the orchestration gateway available to all existing organizations.

    • Customized — Allows you to select the organizations and departments that can use the orchestration gateway.

  5. If you selected Customized, select the required organizations or departments from the list.

    Expand an organization to view and select its child departments, if applicable.

  6. Click Save.

Configuring credential stores

Sectigo orchestration gateways can be configured to utilize credential stores when connecting to remote endpoints. Using a credential store enables you to securely store and manage credentials for remote endpoints without ever providing the credentials in SCM directly.

Sectigo orchestration gateways support the following credential stores:

Adding credential stores

Once an orchestration gateway has been installed, you can add a connection between the gateway and a credential store.

Add a local credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install directory.

  2. Modify the following command to include a name and password for your new local credential store.

    sectigo-og.exe credstore add local --name <name> --encryption_password <password>

  3. Run the modified installation command.

Once you have added a local credential store, you must add credentials before it can be used.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include a name and password for your new local credential store.

    ./sectigo-og credstore add local --name <name> --encryption_password <password>

  3. Run the modified installation command.

Once you have added a local credential store, you must add credentials before it can be used.

  1. Modify the following command to include a name and password for your new local credential store.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add local --name <name> --encryption_password <password>

  2. Run the modified installation command.

Once you have added a local credential store, you must add credentials before it can be used.

Add a HashiCorp Vault credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify one of the following commands based on your preferred authentication method.

    • Token authentication:

      sectigo-og.exe credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type token --token <token>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      The subpath to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --token

      The token to authenticate to vault with.

    • AppRoleSecret authentication:

      sectigo-og.exe credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type app_role_secret --role_secret <role-secret>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      The subpath to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_secret

      Vault Role Secret.

    • AppRoleFile authentication:

      sectigo-og.exe credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type app_role_file --role_file <role-file-path>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      The subpath to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_file

      The path to a file containing the Secret ID for the HashiCorp Vault AppRole used by the orchestration gateway.

  3. Run the modified installation command.

To view details for each option, you can use sectigo-og.exe credstore add hashicorp --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify one of the following commands based on your preferred authentication method.

    • Token authentication:

      ./sectigo-og credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type token --token <token>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      The subpath to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_secret

      Vault Role Secret.

    • AppRoleSecret authentication:

      ./sectigo-og credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type app_role_secret --role_secret <role-secret>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      The subpath to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_secret

      Vault Role Secret.

    • AppRoleFile authentication:

      ./sectigo-og credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type app_role_file --role_file <role-file-path>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      The subpath to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_file

      Path to Vault Role Secret file.

  3. Run the modified installation command.

To view details for each option, you can use ./sectigo-og credstore add hashicorp --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. Modify one of the following commands based on your preferred authentication method.

    • Token authentication:

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type token --token <token>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      Sub path to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_secret

      The Vault role secret.

    • AppRoleSecret authentication:

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type app_role_secret --role_secret <role-secret>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      Sub path to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_secret

      Vault Role Secret.

    • AppRoleFile authentication:

      docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add hashicorp --name <name> --vault_address <address> --secret_engine_path <path> --vault_auth_type app_role_file --role_file <role-file-path>
      Option Description

      --name

      The name of your HashiCorp Vault credential store.

      --vault_address

      The URL of your HashiCorp Vault.

      --secret_engine_path

      Sub path to KVP secrets engine.

      --vault_auth_type

      The authentication type to use.

      --role_file

      Path to Vault Role Secret file.

  2. Run the modified installation command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add hashicorp --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

Add a CyberArk Vault credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the add command as needed..

    sectigo-og.exe credstore add cyberark --name <name> --ccp_url <url> --app_id <app-id> --p12_file <file-path> --p12_password <p12-password> --ca_cert <ca-cert-path>
    Option Description

    --name

    The name of the credential storage provider.

    --app_id

    CyberArk App ID.

    --ccp_url

    CyberArk CCP URL.

    --p12_file

    Path to a p12 file with client auth certificate and key.

    --p12_password

    The P12 file password.

    --ca_cert

    Path to a trusted CA certificate for the CyberArk connection. Required only when the CyberArk instance specified in the --ccp_url uses a certificate that is not trusted by the default certificate store on the host running the orchestration gateway.

    Alternatively, you can add the CA certificate to the trust store. For more information, see Add a trusted CA certificate.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  3. Run the modified installation command.

To view details for each option, you can use sectigo-og.exe credstore add cyberark --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the add command as needed.

    ./sectigo-og credstore add cyberark --name <name> --ccp_url <url> --app_id <app-id> --p12_file <file-path> --p12_password <p12-password> --ca_cert <ca-cert-path>
    Option Description

    --name

    The name of the credential storage provider.

    --app_id

    CyberArk App ID.

    --ccp_url

    CyberArk CCP URL.

    --p12_file

    Path to a p12 file with client auth certificate and key.

    --p12_password

    The P12 file password.

    --ca_cert

    Path to a trusted CA certificate for the CyberArk connection. Required only when the CyberArk instance specified in the --ccp_url uses a certificate that is not trusted by the default certificate store on the host running the orchestration gateway.

    Alternatively, you can add the CA certificate to the trust store. For more information, see Add a trusted CA certificate.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  3. Run the modified installation command.

To view details for each option, you can use sectigo-og.exe credstore add cyberark --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. Modify the add command as needed.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add cyberark --name <name> --ccp_url <url> --app_id <app-id> --p12_file <file-path> --p12_password <p12-password> --ca_cert <ca-cert-path>
    Option Description

    --name

    The name of the credential storage provider.

    --app_id

    CyberArk App ID.

    --ccp_url

    CyberArk CCP URL.

    --p12_file

    Path to a p12 file with client auth certificate and key.

    --p12_password

    The P12 file password.

    --ca_cert

    Path to a trusted CA certificate for the CyberArk connection. Required only when the CyberArk instance specified in the --ccp_url uses a certificate that is not trusted by the default certificate store on the host running the orchestration gateway.

    Alternatively, you can add the CA certificate to the trust store. For more information, see Add a trusted CA certificate.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  2. Run the modified installation command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add cyberark --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

Add a Delinea Secret Server credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the add command as needed.

    sectigo-og.exe credstore add delinea --name <credstore-name> --username <username> --domain <domain> --password <password> --server_url <server-url>
    Option Description

    --name

    The name of the credential store.

    --username

    The username for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --domain

    The domain associated with the user account.

    --password

    The password for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --server_url

    The URL of the Delinea Secret Server. Either this parameter or --api_tenant is required.

    --api_tenant

    The Delinea API tenant identifier. Either this parameter or --server_url is required.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  3. Run the modified installation command.

To view details for each option, you can use sectigo-og.exe credstore add delinea --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the add command as needed.

    ./sectigo-og credstore add delinea --name <credstore-name> --username <username> --domain <domain> --password <password> --server_url <server-url>
    Option Description

    --name

    The name of the credential store.

    --username

    The username for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --domain

    The domain associated with the user account.

    --password

    The password for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --server_url

    The URL of the Delinea Secret Server. Either this parameter or --api_tenant is required.

    --api_tenant

    The Delinea API tenant identifier. Either this parameter or --server_url is required.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  3. Run the modified installation command.

To view details for each option, you can use ./sectigo-og credstore add delinea --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. Modify the add command as needed.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add delinea --name <credstore-name> --username <username> --domain <domain> --password <password> --server_url <server-url>
    Option Description

    --name

    The name of the credential store.

    --username

    The username for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --domain

    The domain associated with the user account.

    --password

    The password for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --server_url

    The URL of the Delinea Secret Server. Either this parameter or --api_tenant is required.

    --api_tenant

    The Delinea API tenant identifier. Either this parameter or --server_url is required.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  2. Run the modified installation command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add delinea --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

Add a BeyondTrust Password Safe credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the add command as needed.

    sectigo-og.exe credstore add beyondtrust --name <credstore-name> --api_url <api-url> --client_id <client-id> --client_secret <client-secret>
    Option Description

    --name

    The name of the credential store.

    --api_url

    The full URL of the BeyondTrust Pathfinder Platform API.

    --client_id

    The BeyondTrust Client ID.

    --client_secret

    The BeyondTrust Client Secret.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  3. Run the modified installation command.

To view details for each option, you can use sectigo-og.exe credstore add beyondtrust --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the add command as needed.

    ./sectigo-og credstore add beyondtrust --name <credstore-name> --api_url <api-url> --client_id <client-id> --client_secret <client-secret>
    Option Description

    --name

    The name of the credential store.

    --api_url

    The full URL of the BeyondTrust Pathfinder Platform API.

    --client_id

    The BeyondTrust Client ID.

    --client_secret

    The BeyondTrust Client Secret.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  3. Run the modified installation command.

To view details for each option, you can use ./sectigo-og credstore add beyondtrust --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

  1. Modify the add command as needed.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add beyondtrust --name <credstore-name> --api_url <api-url> --client_id <client-id> --client_secret <client-secret>
    Option Description

    --name

    The name of the credential store.

    --api_url

    The full URL of the BeyondTrust Pathfinder Platform API.

    --client_id

    The BeyondTrust Client ID.

    --client_secret

    The BeyondTrust Client Secret.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

  2. Run the modified installation command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore add beyondtrust --help.
Once you have added the credential store, you must add endpoints to the orchestration gateway and configure them to use the credential store. For more information, see Add an endpoint.

List all credential stores

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. View all credential stores associated with the orchestration gateway.

    sectigo-og.exe credstore list

  1. In a terminal, navigate to the orchestration gateway install location.

  2. View all credential stores associated with the orchestration gateway.

    ./sectigo-og credstore list

  1. View all credential stores associated with the orchestration gateway.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore list

View a credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --id of the credential store you want to view.

    sectigo-og.exe credstore get --id <credential-store-id>
    Option Description

    --id

    The ID of your credential store instance.

  3. Run the modified command.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --id of the credential store you want to view.

    ./sectigo-og credstore get --id <credential-store-id>
    Option Description

    --id

    The ID of your credential store instance.

  3. Run the modified command.

  1. Modify the following command to include the --id of the credential store you want to view.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore get --id <credential-store-id>
    Option Description

    --id

    The ID of your credential store instance.

  2. Run the modified command.

Updating credential stores

Update a local credential store

If your credential store was created with an orchestration gateway version earlier than v2.0, changing the password will break access to the stored credentials.

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sectigo-og.exe credstore update --id <instance-id> --encryption_password <password>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --encryption_password

    The password for your local store instance.

  3. Run the modified command.

To view details for each option, you can use sectigo-og.exe credstore update --help.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sudo ./sectigo-og credstore update --id <instance-id> --encryption_password <password>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --encryption_password

    The password for your local store instance.

  3. Run the modified command.

To view details for each option, you can use ./sectigo-og credstore update --help.

  1. Modify the following command to include the mandatory --id and any options you want to update.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --id <instance-id> --encryption_password <password>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --encryption_password

    The password for your local store instance.

  2. Run the modified command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --help.

Update a HashiCorp Vault credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sectigo-og.exe credstore update --id <instance-id> --vault_address <address> --secret_engine_path <path> --vault_auth_type token --token <token> --role_secret <role-secret> --role_file <role-file-path>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --vault_address

    The URL of your HashiCorp Vault.

    --secret_engine_path

    The subpath to KVP secrets engine.

    --vault_auth_type

    The authentication type to use.

    The supported values are:

    • token

    • app_role_secret

    • app_role_file

    --token

    The token used to authenticate to HashiCorp Vault.

    Required only when the --vault_auth_type is set to token.

    --role_secret

    Vault Role Secret.

    Required only when the --vault_auth_type is set to app_role_secret.

    --role_file

    The path to a file containing the Secret ID for the HashiCorp Vault AppRole used by the orchestration gateway.

    Required only when the --vault_auth_type is set to app_role_file.

  3. Run the modified command.

To view details for each option, you can use sectigo-og.exe credstore update --help.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sudo ./sectigo-og credstore update --id <instance-id> --vault_address <address> --secret_engine_path <path> --vault_auth_type token --token <token> --role_secret <role-secret> --role_file <role-file-path>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --vault_address

    The URL of your HashiCorp Vault.

    --secret_engine_path

    The subpath to KVP secrets engine.

    --vault_auth_type

    The authentication type to use.

    The supported values are:

    • token

    • app_role_secret

    • app_role_file

    --token

    The token used to authenticate to HashiCorp Vault.

    Required only when the --vault_auth_type is set to token.

    --role_secret

    Vault Role Secret.

    Required only when the --vault_auth_type is set to app_role_secret.

    --role_file

    The path to a file containing the Secret ID for the HashiCorp Vault AppRole used by the orchestration gateway.

    Required only when the --vault_auth_type is set to app_role_file.

  3. Run the modified command.

To view details for each option, you can use ./sectigo-og credstore update --help.

  1. Modify the following command to include the mandatory --id and any options you want to update.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --id <instance-id> --vault_address <address> --secret_engine_path <path> --vault_auth_type token --token <token> --role_secret <role-secret> --role_file <role-file-path>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --vault_address

    The URL of your HashiCorp Vault.

    --secret_engine_path

    The subpath to KVP secrets engine.

    --vault_auth_type

    The authentication type to use.

    The supported values are:

    • token

    • app_role_secret

    • app_role_file

    --token

    The token used to authenticate to HashiCorp Vault.

    Required only when the --vault_auth_type is set to token.

    --role_secret

    Vault Role Secret.

    Required only when the --vault_auth_type is set to app_role_secret.

    --role_file

    The path to a file containing the Secret ID for the HashiCorp Vault AppRole used by the orchestration gateway.

    Required only when the --vault_auth_type is set to app_role_file.

  2. Run the modified command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --help.

Update a CyberArk Vault credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sectigo-og.exe credstore update --id <instance-id> --ccp_url <url> --app_id <app-id> --p12_file <file-path> --p12_password <p12-password> --ca_cert <ca-cert-path> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --ccp_url

    CyberArk CCP URL.

    --app_id

    CyberArk App ID.

    --p12_file

    Path to a p12 file with client auth certificate and key.

    --p12_password

    The P12 file password.

    --ca_cert

    Path to a trusted CA certificate for the CyberArk connection.

    Required only when the CyberArk instance specified in the --ccp_url uses a certificate that is not trusted by the default certificate store on the host running the orchestration gateway.

    Alternatively, you can add the CA certificate to the trust store. For more information, see Add a trusted CA certificate.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  3. Run the modified command.

To view details for each option, you can use sectigo-og.exe credstore update --help.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sudo ./sectigo-og credstore update --id <instance-id> --ccp_url <url> --app_id <app-id> --p12_file <file-path> --p12_password <p12-password> --ca_cert <ca-cert-path> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --ccp_url

    CyberArk CCP URL.

    --app_id

    CyberArk App ID.

    --p12_file

    Path to a p12 file with client auth certificate and key.

    --p12_password

    The P12 file password.

    --ca_cert

    Path to a trusted CA certificate for the CyberArk connection.

    Required only when the CyberArk instance specified in the --ccp_url uses a certificate that is not trusted by the default certificate store on the host running the orchestration gateway.

    Alternatively, you can add the CA certificate to the trust store. For more information, see Add a trusted CA certificate.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  3. Run the modified command.

To view details for each option, you can use ./sectigo-og credstore update --help.

  1. Modify the following command to include the mandatory --id and any options you want to update.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --id <instance-id> --ccp_url <url> --app_id <app-id> --p12_file <file-path> --p12_password <p12-password> --ca_cert <ca-cert-path> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --ccp_url

    CyberArk CCP URL.

    --app_id

    CyberArk App ID.

    --p12_file

    Path to a p12 file with client auth certificate and key.

    --p12_password

    The P12 file password.

    --ca_cert

    Path to a trusted CA certificate for the CyberArk connection.

    Required only when the CyberArk instance specified in the --ccp_url uses a certificate that is not trusted by the default certificate store on the host running the orchestration gateway.

    Alternatively, you can add the CA certificate to the trust store. For more information, see Add a trusted CA certificate.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  2. Run the modified command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --help.

Update a Delinea Secret Server credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sectigo-og.exe credstore update --id <instance-id> --username <username> --domain <domain> --password <password> --server_url <server-url> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --username

    The username for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --domain

    The domain associated with the user account.

    --password

    The password for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --server_url

    The URL of the Delinea Secret Server. Either this parameter or --api_tenant is required.

    --api_tenant

    The Delinea API tenant identifier. Either this parameter or --server_url is required.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  3. Run the modified command.

To view details for each option, you can use sectigo-og.exe credstore update --help.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sudo ./sectigo-og credstore update --id <instance-id> --username <username> --domain <domain> --password <password> --server_url <server-url> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --username

    The username for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --domain

    The domain associated with the user account.

    --password

    The password for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --server_url

    The URL of the Delinea Secret Server. Either this parameter or --api_tenant is required.

    --api_tenant

    The Delinea API tenant identifier. Either this parameter or --server_url is required.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  3. Run the modified command.

To view details for each option, you can use ./sectigo-og credstore update --help.

  1. Modify the following command to include the mandatory --id and any options you want to update.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --id <instance-id> --username <username> --domain <domain> --password <password> --server_url <server-url> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --username

    The username for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --domain

    The domain associated with the user account.

    --password

    The password for the user account used by the orchestration gateway to authenticate to the Secret Server.

    --server_url

    The URL of the Delinea Secret Server. Either this parameter or --api_tenant is required.

    --api_tenant

    The Delinea API tenant identifier. Either this parameter or --server_url is required.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  2. Run the modified command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --help.

Update a BeyondTrust Password Safe credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sectigo-og.exe credstore update --id <instance-id> --api_url <api-url> --client_id <client-id> --client_secret <client-secret> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --api_url

    The full URL of the BeyondTrust Pathfinder Platform API.

    --client_id

    The BeyondTrust Client ID.

    --client_secret

    The BeyondTrust Client Secret.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  3. Run the modified command.

To view details for each option, you can use sectigo-og.exe credstore update --help.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --id and any options you want to update.

    sudo ./sectigo-og credstore update --id <instance-id> --api_url <api-url> --client_id <client-id> --client_secret <client-secret> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --api_url

    The full URL of the BeyondTrust Pathfinder Platform API.

    --client_id

    The BeyondTrust Client ID.

    --client_secret

    The BeyondTrust Client Secret.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  3. Run the modified command.

To view details for each option, you can use ./sectigo-og credstore update --help.

  1. Modify the following command to include the mandatory --id and any options you want to update.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --id <instance-id> --api_url <api-url> --client_id <client-id> --client_secret <client-secret> --use_proxy <true-or-false>
    Option Description

    --id, --i

    The ID of your credential store instance.

    --api_url

    The full URL of the BeyondTrust Pathfinder Platform API.

    --client_id

    The BeyondTrust Client ID.

    --client_secret

    The BeyondTrust Client Secret.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false. To add proxy configuration, see Update proxy server details.

  2. Run the modified command.

To view details for each option, you can use docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore update --help.

Remove a credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In SCM, verify that the credential store you want to remove is not in use by an added endpoint.

  2. In a command prompt window, navigate to the orchestration gateway install location.

  3. Modify the following command to include the --id of the credential store you want to remove.

    sectigo-og.exe credstore remove --id <credential-store-id>

  4. Run the modified command.

  1. In SCM, verify that the credential store you want to remove is not in use by an added endpoint.

  2. In a terminal, navigate to the orchestration gateway install location.

  3. Modify the following command to include the mandatory --id of the credential store you want to remove.

    ./sectigo-og credstore remove --id <credential-store-id>

  4. Run the modified command.

  1. In SCM, verify that the credential store you want to remove is not in use by an added endpoint.

  2. Modify the following command to include the mandatory --id of the credential store you want to remove.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore remove --id <credential-store-id>

  3. Run the modified command.

Managing credentials

Add credentials to a local credential store

The credstore credential add command can only be used with a local credential store.

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --credstore and --id of the credentials you want to add.

    sectigo-og.exe credstore credential add --credstore <instance-id> --id <id> --user <username> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

    --user

    The username for the credential.

    --password

    The password for the credential.

    --ssh_key_path

    The path to the SSH key file.

    --ssh_key_password

    The password for the SSH key.

    --help, -h

    Displays the help information.

  3. Run the modified command.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --credstore and --id of the credentials you want to add.

    ./sectigo-og credstore credential add --credstore <instance-id> --id <id> --user <username> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

    --user

    The username for the credential.

    --password

    The password for the credential.

    --ssh_key_path

    The path to the SSH key file.

    --ssh_key_password

    The password for the SSH key.

    --help, -h

    Displays the help information.

  3. Run the modified command.

  1. In a terminal, modify the following command to include the --credstore and --id of the credentials you want to add.

    docker exec sectigo-network-agent credstore credential add --store <instance-id> --id <id> --user <username> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-key-password>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

    --user

    The username for the credential.

    --password

    The password for the credential.

    --ssh_key_path

    The path to the SSH key file.

    --ssh_key_password

    The password for the SSH key.

    --help, -h

    Displays the help information.

  2. Run the modified command.

Update credentials in a credential store

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --credstore, --id, and the additional options you want to update.

    sectigo-og.exe credstore credential update --credstore <instance-id> --id <id> --user <username> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-password>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

    --user

    The username for the credential.

    --password

    The password for the credential.

    --ssh_key_path

    The path to the SSH key file.

    --ssh_key_password

    The password for the SSH key.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

    --help, -h

    Displays the help information.

  3. Run the modified command.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the mandatory --credstore, --id, and the additional options you want to update.

    ./sectigo-og credstore credential update --credstore <instance-id> --id <id> --user <username> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-password>
    Option Description

    --credstore

    The ID of your local credential store.

    --id

    The ID of the credential.

    --user

    The username for the credential.

    --password

    The password for the credential.

    --ssh_key_path

    The path to the SSH key file.

    --ssh_key_password

    The password for the SSH key.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

    --help, -h

    Displays the help information.

  3. Run the modified command.

  1. Modify the following command to include the mandatory --credstore, --id, and the additional options you want to update.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore credential update --credstore <instance-id> --id <id> --user <username> --password <password> --ssh_key_path <ssh-key-path> --ssh_key_password <ssh-password>
    Option Description

    --credstore

    The ID of your local credential store.

    --id

    The ID of the credential.

    --user

    The username for the credential.

    --password

    The password for the credential.

    --ssh_key_path

    The path to the SSH key file.

    --ssh_key_password

    The password for the SSH key.

    --use_proxy

    Specifies whether to route requests through a configured proxy.

    The possible values are:

    • true — Route requests through the configured proxy.

    • false — Do not route requests through the proxy.

    If omitted, it defaults to false.

    To add proxy configuration, see Update proxy server details.

    --help, -h

    Displays the help information.

  2. Run the modified command.

List all credentials

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --credstore.

    sectigo-og.exe credstore credential list --credstore <instance-id>
    Option Description

    --credstore

    The ID of your credential store instance.

  3. Run the modified command.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --credstore.

    ./sectigo-og credstore credential list --credstore <instance-id>
    Option Description

    --credstore

    The ID of your credential store instance.

  3. Run the modified command.

  1. Modify the following command to include the --credstore.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore credential list --credstore <instance-id>
    Option Description

    --credstore

    The ID of your credential store instance.

  2. Run the modified command.

View credentials

  • Windows ( CLI )

  • Linux

  • Docker

  1. In a command prompt window, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --credstore and --id.

    sectigo-og.exe credstore credential get --credstore <instance-id> --id <id>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

  3. Run the modified command.

  1. In a terminal, navigate to the orchestration gateway install location.

  2. Modify the following command to include the --credstore, and --id.

    ./sectigo-og credstore credential get --credstore <instance-id> --id <id>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

  3. Run the modified command.

  1. Modify the following command to include the --credstore and --id.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore credential get --credstore <instance-id> --id <id>
    Option Description

    --credstore

    The ID of your credential store instance.

    --id

    The ID of the credential.

  2. Run the modified command.

Remove credentials from a local credential store

The credstore credential remove command can only be used with a local credential store.

  • Windows ( CLI )

  • Linux

  • Docker

  1. In SCM, verify that the credentials you want to remove are not in use by an added server.

  2. In a command prompt window, navigate to the orchestration gateway install location.

  3. Modify the following command to include the --credstore and --id of the credentials you want to remove.

    sectigo-og.exe credstore credential remove --credstore <instance-id> --id <id>
    Option Description

    --credstore

    The ID of your local credential store.

    --id

    The ID of the credential.

  4. Run the modified command

  1. In SCM, verify that the credentials you want to remove are not in use by an added server.

  2. In a terminal, navigate to the network agent install location.

  3. Modify the following command to include the --credstore and --id of the credentials you want to remove.

    ./sectigo-og credstore credentials remove --credstore <instance-id> --id <id>
    Option Description

    --credstore

    The ID of your local credential store.

    --id

    The ID of the credential.

  4. Run the modified command

  1. In SCM, verify that the credentials you want to remove are not in use by an added server.

  2. Modify the following command to include the --credstore and --id of the credentials you want to remove.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og credstore credentials remove --credstore <instance-id> --id <id>
    Option Description

    --credstore

    The ID of your local credential store.

    --id

    The ID of the credential.

  3. Run the modified command

Update proxy server details

The following proxy authentication schemes are supported:

  • Digest

  • NTLM (requires a domain to be provided)

  • Basic

  • Windows ( CLI )

  • Linux

  • Docker

To update the proxy server information for your existing orchestration gateway, do the following:

  1. In a command prompt, navigate to the orchestration gateway install location.

  2. (Optional) View the current orchestration gateway configuration.

    sectigo-og.exe proxy get

  3. Update the orchestration gateway proxy configuration.

    Action Command

    Clear proxy settings

    		 
    sectigo-og.exe proxy reset

    Set proxy schema

    The valid schema options are:

    • http: Plain HTTP proxy

    • socks5: SOCKS5 proxy (no TLS)

    • spnego: HTTP Negotiate (Kerberos) with fallback to NTLM

    The command is:

    sectigo-og proxy set --schema <schema>

    Set proxy host and port without access credentials

    		 
    sectigo-og.exe proxy set --url <url:port>

    Set proxy host and port with access credentials

    		 
    sectigo-og.exe proxy set --url <url:port> --user <username> --password <password>
    User can set the proxy schema and URL with username and password at the same time using the combination of command sectigo-og.exe proxy set --schema <schema> --url <url:port> --user <username> --password <password>.

  4. Restart the orchestration gateway service.

    sc stop SectigoOG
    sc start SectigoOG

  5. Confirm the updated orchestration gateway configuration.

    sectigo-og.exe proxy get

To update the proxy server information for your existing orchestration gateway, do the following:

  1. In a terminal, navigate to the orchestration gateway install location.

  2. (Optional) View the current orchestration gateway configuration.

    ./sectigo-og proxy get

  3. Update the orchestration gateway configuration.

    Action Command

    Clear proxy settings

    		 
    ./sectigo-og proxy reset

    Set proxy schema

    The valid schema options are:

    • http: Plain HTTP proxy

    • socks5: SOCKS5 proxy (no TLS)

    • spnego: HTTP Negotiate (Kerberos) with fallback to NTLM

    The command is:

    ./sectigo-og proxy set --schema <schema>

    Set proxy host and port without access credentials

    		 
    ./sectigo-og proxy set --url <url:port>

    Set proxy host and port with access credentials

    		 
    ./sectigo-og proxy set --url <url:port> --user <username> --password <password>
    User can set the proxy schema and url with username and password at the same time using the combination of command ./sectigo-og proxy set --schema <schema> --url <url:port> --user <username> --password <password>.

  4. Restart the orchestration gateway service.

    sudo systemctl restart sectigo-orchestration-gateway

  5. Confirm the updated orchestration gateway configuration.

    ./sectigo-og proxy get

To update the proxy server information for your existing orchestration gateway, do the following:

  1. (Optional) View the current orchestration gateway configuration.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy get

  2. Update the orchestration gateway configuration.

    Action Command

    Clear proxy settings

    		 
    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy reset

    Set proxy schema

    The valid schema options are:

    • http: Plain HTTP proxy

    • socks5: SOCKS5 proxy (no TLS)

    • spnego: HTTP Negotiate (Kerberos) with fallback to NTLM

    The command is:

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy set --schema <schema>

    Set proxy host and port without access credentials

    		 
    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy set --url <url:port>

    Set proxy host and port with access credentials

    		 
    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy set --url <url:port> --user <username> --password <password>
    User can set the proxy schema and url with username and password at the same time using the combination of command docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy set --schema <schema> --url <url:port> --user <username> --password <password>.

  3. Restart the docker container.

    docker exec service sectigo-orchestration-gateway restart

  4. Confirm the updated orchestration gateway configuration.

    docker exec <container> /opt/sectigo-orchestration-gateway/bin/sectigo-og proxy get

Add a trusted CA certificate

To download a CA certificate, see Download a CA certificate.

  • Windows

  • Linux

  1. Run Manage Computer Certificates.

    In the Windows search bar, search for Manage Computer Certificates.

  2. In the left-hand list, select Trusted Root Certification Authorities.

  3. Right-click Certificates and select Certificates  All Tasks  Import.

    In the Certificate Import Wizard, ensure Store Location is set to Local Machine.

  4. Click Next.

  5. Click Browse and add your certificate file.

  6. Click Next, Next, Finish.

  7. Repeat the above steps to add the certificate to Intermediate Certification Authorities.

  1. Navigate to the orchestration gateway installation directory.

  2. Add your CA certificate to the trusted CA list.

    ./sectigo-og truststore add --path <your-path-of-ca-cert>

Discover certificates using orchestration gateway

Discovery tasks are used to scan and monitor networks for SSL certificates.

You can use an orchestration gateway to discover SSL certificates on the network. For more information, see Discover SSL certificates.

Uninstall an orchestration gateway

  • Windows

  • Linux APT ( DEB )

  • Linux DNF ( RPM )

  1. Navigate to Settings  Apps & features.

  2. Search for Sectigo Orchestration Gateway.

  3. Select the Sectigo Orchestration Gateway and click Uninstall.

  4. (Optional) Delete the files and logs associated with the orchestration gateway.

    1. Navigate to C:\ProgramData\Sectigo.

    2. Delete the Sectigo Orchestration Gateway folder.

      This action cannot be undone. Delete this folder if you want to completely remove all files and logs related to the orchestration gateway.

  5. In SCM, navigate to Integrations  Orchestration Gateways.

  6. Select the gateway you want to delete.

  7. Click the Delete icon.

  8. Click Delete to confirm deletion.

  1. Remove the orchestration gateway.

    sudo apt remove sectigo-orchestration-gateway

  2. (Optional) Delete the files and logs associated with the orchestration gateway.

    1. Navigate to the /var/log directory.

    2. Delete the sectigo-orchestration-gateway directory.

      This action cannot be undone. Delete this directory if you want to completely remove all files and logs related to the orchestration gateway.

  3. Delete the config files associated with the orchestration gateway.

    1. Navigate to the /opt directory.

    2. Delete the sectigo-orchestration-gateway directory.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select the orchestration gateway you want to delete.

  6. Click Delete.

  7. Click Delete to confirm deletion.

  1. Remove the orchestration gateway.

    sudo dnf remove sectigo-orchestration-gateway

  2. (Optional) Delete the files and logs associated with the orchestration gateway.

    1. Navigate to the /var/log directory.

    2. Delete the sectigo-orchestration-gateway directory.

      This action cannot be undone. Delete this directory if you want to completely remove all files and logs related to the orchestration gateway.

  3. Delete the config files associated with the orchestration gateway.

    1. Navigate to the /opt directory.

    2. Delete the sectigo-orchestration-gateway directory.

  4. In SCM, navigate to Integrations  Orchestration Gateways.

  5. Select the orchestration gateway you want to delete.

  6. Click Delete.

  7. Click Delete to confirm deletion.

Orchestration gateway service commands

  • Windows

  • Linux ( systemd )

Command Description

Start

Start an orchestration gateway:

sc start SectigoOG

Stop

Stop an orchestration gateway:

sc stop SectigoOG

Query

Query the status of an orchestration gateway:

sc query SectigoOG
Command Description

Start

Start an orchestration gateway:

sudo systemctl start sectigo-orchestration-gateway

Stop

Stop an orchestration gateway:

sudo systemctl stop sectigo-orchestration-gateway

Restart

Restart an orchestration gateway:

sudo systemctl restart sectigo-orchestration-gateway

Status

Query the status of an orchestration gateway:

sudo systemctl status sectigo-orchestration-gateway