The ePO - On-prem server relies on three security key pairs.
The three security pairs are used to:
Authenticate agent-server communication.
Verify the contents of local repositories.
Verify the contents of remote repositories.
Each pair's secret key signs messages or packages at their source, while the pair's public key verifies the messages or packages at their target.
Agent-server secure communication (ASSC) keys
The first time the agent communicates with the server, it sends its public key to the server.
From then on, the server uses the agent public key to verify messages signed with the agent's secret key.
The server uses its own secret key to sign its message to the agent.
The agent uses the server's public key to verify the server's message.
You can have multiple secure communication key pairs, but only one can be designated as the main key.
When the client agent key updater task runs (Trellix ePO Agent Key Updater), agents using different public keys receive the current public key.
When you upgrade, existing keys are migrated to your ePO - On-prem server.
Local main repository key pairs
The repository secret key signs the package before it is checked in to the repository.
The repository public key verifies repository package contents.
The agent retrieves available new content each time the client update task runs.
This key pair is unique to each server.
By exporting and importing keys among servers, you can use the same key pair in a multi-server environment.
Other repository key pairs
The secret key of a trusted source signs its content when posting that content to its remote repository. Trusted sources include the Trellix download site and the Trellix Security Innovation Alliance (SIA) repository.
Caution
If this key is deleted, you cannot perform a pull, even if you import a key from another server. Before you overwrite or delete this key, make sure to back it up in a secure location.
The Trellix Agent public key verifies content that is retrieved from the remote repository.