Client Installation

CORE client software installation steps:

  1. Prerequisites:
  2. Install using one of the following options:

To finalize the client's deployment, register it with the relevant CORE partitions. See example in Client Activation Quickstart.

Install CORE Client

  1. Install:
  2. Run the ucl version command for a quick sanity check.
  3. Continue to Set the Mandatory Settings.

Set the Mandatory Settings

It is mandatory to customize the servers setting, while the rest of the settings are set to their default values.

The servers setting is a comma-separated list of EP servers URLs:
<EP1>[:<TCP/IP port>] [,<EP2>[:<TCP/IP port>]] [,<EP3>[:<TCP/IP port>]]
The default port is 443. For additional info, see Servers Setting .

You have two options to customize the installed client's setting: automatic and manual.

Automatic Configuration

During CORE client software initial deployment or upgrade, the client settings may be automatically modified as specified in the install_props.txt file.

  1. Prerequisites:
  2. The install_props.txt file must be located in the same directory as the installation software.

  3. Entries in the file use the name=value format.
  4. The only mandatory entry in the file is the servers= setting. For example, servers=ep1.

You may use this file to customize any setting listed in the Client Installation. For example
app_arg_full = java|openssl

Manual Configuration

Test the Settings

Run the ucl diagnose command. Since we have not yet registered with any CORE partition, the expected response is:

Error (ucl): No partition found

Any other response indicates an error in the servers setting.

CORE Client Activation

Accessing a key material using the CORE client requires possession of the corresponding partition's certificate. Such a certificate may be:

  • issued by CORE CA or by the tenant's CA.
  • persistent or ephemeral.
  • issued for the particular CORE client appliance or a group of appliances.

These options are further specified in Client Types and Certificates. In the following example, we use the registration method to obtain a persistent certificate issued by the CORE CA for client by name "my-pc".

Client Activation Quickstart

The following example shows how to obtain a certificate for partition "test" that was created in Quickstart on Linux. We assume the following:

Step Run-on Command
1 EP

Create an activation code that allows "my-pc" obtain the "test" partition's certificate:

ucl client create \
-p test -n my-pc -m ACTIVATE --user so -w Password2!

Note: The output of this command is an activation code. It is valid for a few minutes as defined in the partition's settings.




Use the activation code to complete the registration, obtain and install the required certificate:

ucl register -p test -n my-pc --code <activation code>


Check the system's readiness to handle your requests.

ucl diagnose -p test

Note: This step is optional. Use it for your information or to collect the troubleshooting info.


Create and display an RSA key:

ucl generate -t rsa --name my-rsa1
ucl show --name my-rsa1

Troubleshooting the Server's Certificate

CORE client addresses an EP by its hostname, FQDNClosedFully-qualified domain name - The complete domain name for a specific computer or host.-name, or IP address as stored in its servers setting. During the SSLClosedSecure Sockets Layer - a cryptographic protocol that provides communications security over a computer network. handshake, the CORE server provides its certificate where the server is identified by the following:

The client validates that one of these entries is equal to the entry it had selected from its servers setting. A mismatch results in an error that may be fixed by either changing the servers setting or updating the SANClosedSubject Alternative Names - Certificate field with a list of IP addresses. list in the certificate. To update the SANClosedSubject Alternative Names - Certificate field with a list of IP addresses. list, use the ekm_renew_server_certificate script.