> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Master Certificate Management

> Manage the Syteca Master Certificate (EkranMasterCertificate) — back up, delete, import, reissue, and optionally migrate from RSA-2048 to RSA-4096 encryption. Essential for Application Server recovery, migration, and High Availability setup.

## The single most important backup in your Syteca deployment

The **Syteca Master Certificate** — internally named `EkranMasterCertificate` — sits at the root of Syteca's encryption hierarchy. It encrypts the Data Protection certificate (which encrypts every screen capture), the TOTP initial vectors, the database connection string, and the password protecting the symmetric key for logged keystrokes. **Without it, the Syteca database is unreadable. There is no recovery mechanism.**

That makes the Master Certificate the single most important artifact to back up. Every operational scenario that involves moving Syteca — Application Server recovery after host failure, migration to a new server, High Availability cluster setup, system upgrade, even reinstalling on the same host with a preserved database — depends on having a working backup of this certificate. Compare this to general key management in CyberArk (Vault Server keys), Delinea (Encryption Key), and BeyondTrust (Master Key): the cryptographic foundation under all of them is similar; what matters is whether your operations team treats it with the same seriousness.

<Warning>
  **NOT AVAILABLE IN SAAS.** The Master Certificate is managed by the vendor in SaaS deployments — customers don't perform these operations. This procedure applies to **on-premises** deployments only.
</Warning>

<Note>
  Master Certificate operations require **administrator access to the Application Server computer**. The operations themselves are performed via the **Microsoft Management Console (MMC)** Certificates snap-in, scoped to the **Local Computer account → Personal → Certificates** store.
</Note>

## When you need this

| Scenario                                                                   | Operations required                                                                                                                                                                                           |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **First time installing the Application Server**                           | After install, [back up](#back-up-the-master-certificate) immediately. Store the backup in a secure location separate from the Application Server host.                                                       |
| **Reinstalling on the same host, reusing the existing database**           | [Delete](#delete-the-master-certificate) the newly-generated certificate; [import](#import-the-master-certificate) the original backup.                                                                       |
| **Migrating to a different Application Server host**                       | On the old host: [back up](#back-up-the-master-certificate). On the new host: install Application Server selecting **Use an existing certificate**, then [import](#import-the-master-certificate) the backup. |
| **High Availability cluster — adding additional Application Server nodes** | [Back up](#back-up-the-master-certificate) from the first node. On each additional node, [import](#import-the-master-certificate) the backup before installing the Application Server.                        |
| **Master Certificate has expired**                                         | [Reissue](#reissue-the-master-certificate) the certificate. The system continues operating with an expired certificate, but generates ongoing Windows Event log alerts until reissued.                        |
| **Upgrading deployment to RSA-4096 encryption** *(post-v.7.23)*            | Use the **Migrate Master Certificate to 4096-bit** option in the Database Parameters tool — see [Migrate to RSA-4096](#migrate-to-rsa-4096) below.                                                            |

## Back up the Master Certificate

The backup is a `.pfx` file (Personal Information Exchange) containing the certificate and its private key, protected with a password you set during export. Keep both the file and the password somewhere safe and **not on the Application Server host itself**.

<Steps>
  <Step title="Open MMC on the Application Server">
    On the Application Server computer, press **Windows + R**, enter `mmc` in the **Run** window, and press **Enter**. Click **Yes** in the User Account Control prompt.
  </Step>

  <Step title="Add the Certificates snap-in">
    In the **Console** window, select **File → Add/Remove Snap-in**. In the **Add or Remove Snap-ins** window, select **Certificates**, then click **Add**.

    In the **Certificates Snap-in** window, select **Computer account**, then click **Next**. In the **Select Computer** window, select **Local computer**, then click **Finish**. Back in the **Add or Remove Snap-ins** window, click **OK**.
  </Step>

  <Step title="Locate EkranMasterCertificate">
    In the **Certificates (Local Computer)** tree-view, expand **Personal → Certificates**. Find the certificate named `EkranMasterCertificate`.
  </Step>

  <Step title="Start the Certificate Export Wizard">
    Right-click `EkranMasterCertificate`, then select **All Tasks → Export** from the context menu. The **Certificate Export Wizard** opens; click **Next** on the welcome page.
  </Step>

  <Step title="Export the private key">
    On the **Export Private Key** page, select **Yes, export the private key**, then click **Next**.

    <Warning>
      Without the private key, the export is **useless** for recovery. Always export the private key when backing up the Master Certificate.
    </Warning>
  </Step>

  <Step title="Choose the file format">
    On the **Export File Format** page, select **Personal Information Exchange** and the following options under it:

    * **Include all certificates in the certification path if possible**
    * **Export all extended properties**

    Click **Next**.
  </Step>

  <Step title="Set a password">
    On the **Security** page, select the **Password** checkbox, then enter and confirm a password.

    <Warning>
      **Remember this password.** You'll need it to restore the certificate or import it on another host. There is no password-reset path — if you lose the password, the backup is unusable.
    </Warning>

    Click **Next**.
  </Step>

  <Step title="Save the file">
    On the **File to Export** page, specify the location and filename for the `.pfx` file. Pick a meaningful name like `EkranMasterCertificate-<deployment>-<date>.pfx`. Click **Next**, then **Finish** on the completion page.
  </Step>
</Steps>

<Tip>
  Store the `.pfx` file and its password **separately** — for example, the file in a secured network share or backup vault, and the password in a password manager or sealed envelope. Storing both together on the same machine defeats the purpose.
</Tip>

## Delete the Master Certificate

Deletion is needed in two scenarios: (1) cleaning up a duplicate certificate before a fresh install, and (2) replacing the certificate after a [reissue](#reissue-the-master-certificate).

<Warning>
  **Never delete the Master Certificate without a verified backup** unless you've already imported a replacement. Without the certificate, the Syteca database becomes unreadable.
</Warning>

<Steps>
  <Step title="Open MMC and the Certificates snap-in">
    On the Application Server computer, press **Windows + R**, enter `mmc`, then press **Enter**. Click **Yes** in the UAC prompt.

    In the **Console** window: **File → Add/Remove Snap-in → Certificates → Add → Computer account → Next → Local Computer → Finish → OK**.
  </Step>

  <Step title="Locate EkranMasterCertificate">
    In the **Certificates (Local Computer)** tree-view, expand **Personal → Certificates**. Find `EkranMasterCertificate`.
  </Step>

  <Step title="Delete">
    Right-click `EkranMasterCertificate`, then select **Delete** in the context menu. Click **Yes** in the confirmation message.
  </Step>
</Steps>

## Export the master certificate

<Warning>
  **NOT AVAILABLE IN SAAS.**
</Warning>

Exporting the master certificate produces a file you can copy to another computer and [import](/docs/administration/security/master-certificate#import-the-master-certificate) there — for example, when moving an MS SQL Server database signed with the certificate to a different machine.

<Steps>
  <Step title="Open the Certificates snap-in">
    On the Application Server computer, press **Windows+R**, enter `mmc`, and press **Enter**. Click **Yes** on the User Account Control prompt.
  </Step>

  <Step title="Add the Certificates snap-in">
    In the Console window, select **File > Add/Remove Snap-in**. Select **Certificates** and click **Add**.
  </Step>

  <Step title="Target the local computer account">
    Select **Computer account**, click **Next**, select **Local computer: (the computer this console is running on)**, and click **Finish**. Click **OK** to close the Add or Remove Snap-ins window.
  </Step>

  <Step title="Locate the certificate">
    In the tree view, select **Certificates (Local Computer) > Personal > Certificates**, and find the master certificate used to sign monitoring data in the database.
  </Step>

  <Step title="Start the export">
    Right-click the certificate and select **All Tasks > Export**.
  </Step>

  <Step title="Complete the Certificate Export Wizard">
    Click **Next** through the **Welcome** and **Export Private Key** pages, select the export **file format**, click **Next**, specify where to save the exported file and its name (or use **Browse**), click **Next**, then **Finish**.
  </Step>

  <Step title="Move the file to the destination computer">
    Copy the exported certificate file to the new computer, then [import it](/docs/administration/security/master-certificate#import-the-master-certificate) there.
  </Step>
</Steps>

<Frame caption="Selecting an export format in the Certificate Export Wizard.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/administration/security/master-certificate-export-wizard.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=0fe0c6f45ce753beab21e76cc6662446" alt="Certificate Export Wizard Export File Format page" width="1153" height="803" data-path="images/administration/security/master-certificate-export-wizard.png" />
</Frame>

## Import the Master Certificate

Restoring from a `.pfx` backup — used after reinstallation, host migration, HA cluster setup, or reissue.

<Steps>
  <Step title="Open MMC and the Certificates snap-in">
    On the Application Server computer, press **Windows + R**, enter `mmc`, press **Enter**, click **Yes** in the UAC prompt.

    In the **Console** window: **File → Add/Remove Snap-in → Certificates → Add → Computer account → Next → Local Computer → Finish → OK**.
  </Step>

  <Step title="Start the Certificate Import Wizard">
    In the **Console** window, select **Action → All Tasks → Import**. The **Certificate Import Wizard** opens; click **Next** on the welcome page.
  </Step>

  <Step title="Pick the file">
    On the **File to Import** page, click **Browse**, select the `.pfx` backup file, then click **Next**.
  </Step>

  <Step title="Enter the password">
    On the **Private Key Protection** page, enter the password you set during backup, then click **Next**.
  </Step>

  <Step title="Pick the destination store">
    On the **Certificate Store** page, select **Place all certificates in the following folder**, click **Browse**, select **Personal**, then click **Next**.
  </Step>

  <Step title="Finish">
    Click **Finish** on the completion page.
  </Step>
</Steps>

## Reissue the Master Certificate

The Master Certificate has an expiration date. Expiration does **not** stop Syteca from functioning - the system continues operating normally - but the Application Server starts logging alerts to the Windows Event log about the expiration. Reissue replaces the certificate so the alerts stop.

<Frame caption="The Database Parameters tool's Advanced tab - Reissue Master Certificate is the primary action, with the Migrate Master Certificate to 4096-bit button visible above it for deployments upgraded to v.7.23+.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/administration/security/database-parameters-advanced-tab.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=2420ed77b0005a1836de236fed744670" alt="Database Parameters DbSetupToolUI Advanced tab showing the Reissue Master Certificate button and Migrate Master Certificate to 4096-bit button" width="504" height="517" data-path="images/administration/security/database-parameters-advanced-tab.png" />
</Frame>

<Steps>
  <Step title="Sign in as a local administrator">
    Log in to the Application Server host as an **admin user**.
  </Step>

  <Step title="Open Database Parameters">
    In the Windows Notification area, right-click the **Syteca Server** tray icon and select **Database Parameters** to open the **`DbSetupToolUI`** application.
  </Step>

  <Step title="(Optional) Migrate to RSA-4096 first">
    If your deployment was upgraded **to Syteca v.7.23 or higher** and the Master Certificate hasn't been migrated yet, the **Advanced** tab displays a **Migrate Master Certificate to 4096-bit** button. See [Migrate to RSA-4096](#migrate-to-rsa-4096) below — complete that migration **before** clicking Reissue.
  </Step>

  <Step title="Click Reissue Master Certificate">
    On the **Advanced** tab, click **Reissue Master Certificate**.
  </Step>

  <Step title="Authenticate as a system-configuration admin">
    In the **Credentials required** pop-up, enter the **User name** and **Password** of a user with the [administrative Tenant Management and System Configuration permission](/docs/administration/users/administrative-permissions#tenant-management-and-system-configuration), then click **Next**.
  </Step>

  <Step title="Save the new certificate file">
    In the **Certificate generated successfully** pop-up, the system displays the password of the new Master Certificate. **Copy and save this password** somewhere secure — you'll need it when importing.

    Click **Save**. In the **Save as** window, choose a location and click **Save**.
  </Step>

  <Step title="Complete the reissue lifecycle">
    The reissue alone doesn't stop the Windows Event log alerts. Three follow-up steps are required:

    1. [Back up the **existing** (about-to-be-replaced) Master Certificate](#back-up-the-master-certificate) as a final fallback.
    2. [Delete the **existing** Master Certificate](#delete-the-master-certificate) from the Certificate Store.
    3. [Import the **new** Master Certificate](#import-the-master-certificate) that was just generated.

    After completing all three, the expiration alerts stop.
  </Step>
</Steps>

<Note>
  A reissue is recorded in the Management Tool's [Audit log](/docs/administration/audit-log) as: `Configuration / Generating / The user has issued and saved a new Master Certificate.`
</Note>

## Migrate to RSA-4096

For deployments upgraded **to Syteca v.7.23 or higher** from earlier versions, the Master Certificate remains at its original **RSA-2048** encryption. An optional migration to **RSA-4096** is available — providing stronger encryption for the entire key hierarchy. The migration is one-way (RSA-4096 cannot be downgraded back to RSA-2048 in-place).

<Note>
  **New deployments** of Syteca v.7.23 or higher generate the Master Certificate at the version's default encryption strength. The Migrate option is only relevant for existing deployments that have been **upgraded** from an earlier version.
</Note>

<Steps>
  <Step title="Open Database Parameters">
    Right-click the **Syteca Server** tray icon and select **Database Parameters** to open the `DbSetupToolUI` application.
  </Step>

  <Step title="Click Migrate Master Certificate to 4096-bit">
    On the **Advanced** tab, click **Migrate Master Certificate to 4096-bit**. The button only appears if the deployment is on v.7.23 or higher and the Master Certificate is still RSA-2048.
  </Step>

  <Step title="Follow the on-screen instructions">
    A series of pop-up windows guides the migration process. Follow each pop-up's instructions.
  </Step>

  <Step title="Verify completion">
    Once migration completes, the **Migrate Master Certificate to 4096-bit** button no longer appears on the Advanced tab. The **Reissue Master Certificate** button is now available for use on the migrated certificate.
  </Step>
</Steps>

## Related

<CardGroup cols={2}>
  <Card title="Encryption architecture" icon="lock" href="/docs/administration/security/encryption">
    The full key hierarchy — Master Certificate, Data Protection certificate, AES-256, RSA-2048/4096, Diffie-Hellman.
  </Card>

  <Card title="Install Application Server" icon="server" href="/docs/administration/deployment/install-application-server">
    Where the Master Certificate is first generated.
  </Card>

  <Card title="HSM-based Master Certificate" icon="server-cog" href="/docs/administration/integrations/thales-hsm">
    Store the Master Certificate in a Thales HSM instead of the Windows Certificate Store.
  </Card>

  <Card title="Update Syteca" icon="arrow-up" href="/docs/administration/deployment/update-syteca">
    The full upgrade procedure — includes the Master Certificate backup step before updating.
  </Card>
</CardGroup>