General information
The Thycotic agents will make the following changes to the endpoint(s) during installation:
- Agent binary files will be installed to multiple directories under the default location C:\Program Files\Arellia
- Agent configuration files will be installed to multiple directories under C:\ProgramData\Arellia
- A firewall rule will be added that allows inbound traffic to the Thycotic Agents on TCP port 5593
- A digital certificate will be selected for use in encrypting client/server communications
Criteria for evaluating pre-existing digital certificates
Pre-existing certificates that match the following criteria will be used:
- Certificates that belong in the Local Machine store and are issued to the hostname or FQDN of the endpoint
- Certificates that specify a Subject Alternative Name whose DNS Name matches the machine FQDN
- Certificates whose intended purpose must be for All Purposes or Client Authentication
- Certificates whose chains must only contain trusted Certification Authorities
- Certificates that have a private key that LocalSystem and the Administrators group can read
If multiple certificates meet the previous criteria, then the following selection priority will be used:
| Priority 1 | Certificates issued by a trusted Certification Authority to the FQDN of the endpoint |
| Priority 2 | Certificates issued by a trusted Certification Authority to the hostname (or FQDN using Subject Alternative Name) of the endpoint |
| Priority 3 | Self-signed certificates issued to the FQDN of the endpoint |
| Priority 4 | Self-signed certificates issued to the hostname (or FQDN using Subject Alternative Name) of the endpoint |
The Thycotic agents will:
- select certificates that match the priority level of the certificate with the longest validity from the current date.
- generate its own trusted self-signed certificate if it does not identify an existing one