The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

IVX TLS Certificate Configuration on Trellix TIE

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next

Before TIE can submit files to IVX, you need to ensure that the keystore on each of your TIE servers has the relevant TLS certificate(s) so that TIE can successfully validate the connection to the IVX server(s). These steps must be completed to ensure the successful operation of the TIE integration with IVX. These steps apply whether you have installed custom TLS certificates on IVX or are using the default. This documentation does not cover the deployment of custom certificates on IVX. For that information, see the IVX product documentation.

  • The IVX Java truststore is located at: /var/Trellix/tieserver/keystore/vx_servers_truststore.jks. This file will not exist initially and will be created when you first add a certificate using the steps below.

  • If you have a Primary-Secondary server configuration, repeat the following steps in the Primary and all Secondary instances of your appliances.

  1. Download the certificates for your IVX server(s) that you configured in the policies. If you have multiple IVX servers, be sure to give each certificate a unique name.

    For TIE in IPv4 (default) mode:

    echo | openssl s_client -connect <IVX Server IP>:443 2>/dev/null | openssl x509 -outform der -out /var/Trellix/tieserver/keystore/vx_server_1.der

    For TIE in IPv6 mode:

    LD_LIBRARY_PATH=/usr/sbin/openssl3 ./usr/sbin/openssl3/openssl s_client -connect "[&lt;IVX Server IPv6 Address&gt;]:443" 2&gt;/dev/null | openssl x509 -outform der -out /var/Trellix/tieserver/keystore/vx_server_1.der

  2. Add the IVX certificates to the Java truststore. If you have multiple IVX servers, be sure to give each certificate a unique alias.

    yes | /opt/Trellix/tieserver/jre/bin/keytool -import -file /var/Trellix/tieserver/keystore/vx_server_1.der -alias vx_server_1 -storepass -noprompt -keystore /var/Trellix/tieserver/keystore/vx_servers_truststore.jks

  3. Change ownership and permissions on the IVX truststore.

    chown mfetie:mfetie /var/Trellix/tieserver/keystore/vx_servers_truststore.jks; chmod 600 /var/Trellix/tieserver/keystore/vx_servers_truststore.jks

  4. (Optional) Verify that the certificates are added correctly.

    /opt/Trellix/tieserver/jre/bin/keytool -keystore /var/Trellix/tieserver/keystore/vx_servers_truststore.jks -list -v -storepass -noprompt

  5. (Optional) You can delete the .der files created in Step (1), because these are no longer required.

    For details on certificate validation between TIE and IVX, see KB96740.

Related articles
  • IVX TLS Certificate Configuration on Trellix TIE
    Threat Intelligence Exchange (TIE) > TIE 4.x > Trellix Threat Intelligence Exchange 4.5.x Product Guide > PG - TIE - Using Threat Intelligence Exchange in your environment > Using Threat Intelligence Exchange > Submitting file samples to IVX
  • IVX TLS Certificate Configuration on Trellix TIE
    Threat Intelligence Exchange (TIE) > TIE 4.x > Trellix Threat Intelligence Exchange (TIE) 4.6.x Product Guide > Using Threat Intelligence Exchange > Submitting files to Sandboxing servers > Submitting file samples to IVX
  • IVX TLS Certificate Configuration on TIE
    Threat Intelligence Exchange (TIE) > TIE 4.x > Trellix Threat Intelligence Exchange 4.5.x Installation Guide > Post-installation tasks