Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,20 @@ sidebar_position: 30

# Signing Key Utility

This utility was created to remediate the vulnerability described in Netwrix security advisory
Netwrix created this utility to remediate the vulnerability described in Netwrix security advisory
ADV-2025-004
([https://security.netwrix.com/Advisories/ADV-2025-004](https://security.netwrix.com/Advisories/ADV-2025-004)).
Running this utility will cause a new customer-specific signing key to be generated and used by the
application. See the Generate a Signing Key section for additional information.
Running this utility generates a new customer-specific signing key for the application to use. See
the Generate a Signing Key section for additional information.

Having generated the customer-specific signing key, your existing schedules will not work as their
authentication mechanism will no longer be considered valid. Therefore, the authentication mechanism
must be updated for schedules as well. See the Update Schedules section for additional information.
After you generate the customer-specific signing key, your existing schedules will not work because
their authentication mechanism will no longer be valid. Therefore, you must also update the
authentication mechanism for schedules. See the Update Schedules section for additional information.

In case you are running multiple instances of Directory Manager for load balancing and high
availability, using this utility you can export the newly generated signing key and then import it
to other Directory Manager instances. See the following sections for information on how to export
and import the signing key:
If you run multiple instances of Directory Manager for load balancing and high availability, you can
use this utility to export the newly generated signing key and then import it to other Directory
Manager instances. See the following sections for information on how to export and import the
signing key:

- Export a Signing Key
- Import a Signing Key
Expand All @@ -31,13 +31,13 @@ following URLs:

- Pre v11.1 (2.1, 2.2, 2.3, 2.4)

[https://releases.netwrix.com/products/directorymanager/11.0/directorymanager-Signing-Key-Utility-11.0.0.zip](https://releases.netwrix.com/products/directorymanager/11.0/directorymanager-Signing-Key-Utility-11.0.0.zip)
[https://releases.netwrix.com/products/groupid/11.0/groupid-Signing-Key-Utility-11.0.0.zip](https://releases.netwrix.com/products/groupid/11.0/groupid-Signing-Key-Utility-11.0.0.zip)

- For v11.1

[https://releases.netwrix.com/products/directorymanager/11.1/directorymanager-Signing-Key-Utility-11.1.0.zip](https://releases.netwrix.com/products/directorymanager/11.1/directorymanager-Signing-Key-Utility-11.1.0.zip)
[https://releases.netwrix.com/products/groupid/11.1/groupid-Signing-Key-Utility-11.1.0.zip](https://releases.netwrix.com/products/groupid/11.1/groupid-Signing-Key-Utility-11.1.0.zip)

The file is downloaded into a folder as per your browser’s download settings. Unzip the file into a
Your browser downloads the file into a folder based on its download settings. Unzip the file into a
folder.

## Generate a Signing Key
Expand All @@ -50,17 +50,17 @@ Generate the new signing key on your Directory Manager server machine.
:::


Follow the steps to generate a new signing key.
To generate a new signing key:

Step 1 – At the Windows Command prompt, go to the folder where you have placed the utility.
1. At the Windows Command prompt, go to the folder where you have placed the utility.

Step 2 – Type the following command at the prompt:
2. Enter the following command at the prompt:

```
SigningKeyUtility.exe GenerateSigningKey -u “<DB username>” -s “<SQLServer name>” -d “<DB name>” -i
```

Step 3 – Provide the password of SQL server for authentication.
3. Provide the password of SQL server for authentication.

Parameters:

Expand Down Expand Up @@ -89,7 +89,7 @@ SigningKeyUtility.exe UpdateSchedulers -u “<DB username>” -s “<SQLServer n
## Export a Signing Key

If you are using multiple instances of Directory Manager, then you need to export the newly
generated signing key to other instances of Directory Manager. Type the following command at the
generated signing key to other instances of Directory Manager. Enter the following command at the
Windows Command prompt to export the signing key in .pfx. encrypted format with a password:

```
Expand All @@ -100,12 +100,12 @@ SigningKeyUtility.exe ExportSigningKey -o “<Folder location for signingkey exp

- -o — provide folder location where the utility will export the signing key

This command will generate a password for the encrypted signing key. Copy it and keep it safe for
later use. The encrypted signing key is saved in the specified folder.
This command generates a password for the encrypted signing key. Copy it and keep it safe for later
use. The utility saves the encrypted signing key in the specified folder.

## Import a Signing Key

Copy the newly generated signing key on the required Directory Manager instance. Type the following
Copy the newly generated signing key on the required Directory Manager instance. Enter the following
command at the Windows Command prompt to import the signing key which is in .pfx encrypted format:

```
Expand Down
Loading