Skip to main content
tiCrypt

Escrow Certificates

Prerequisites

User Role:

Super-admin

Permission Requirements

  • Key Escrow
    • Put their own private key in escrow
    • Check whether their own key is in escrow
  • Key Escrow Administration
    • View all keys in escrow
    • View escrow recovery keys
    • Delete keys from escrow, with their recovery parts
    • View escrow groups
    • View escrow users
    • View escrow public keys
    • View the history of escrow actions approved with a Sitekey

View Escrow Certificates​

The Escrow Certificates table is the history of every Sitekey-signed action applied on this deployment. It requires the View the history of escrow actions approved with a Sitekey permission. The table shows Type (the request type, such as add-escrow-user or new-escrow-group), Signed, and Signed By; a CSV or Excel export adds Signer ID and Signer Name.

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click the Escrow Certificates in the left panel.
  4. Select one escrow certificate.
  5. Click the View certificate JSON button in the top right panel.
  6. In the dialog, titled with the certificate's request type, read "Signed by <name> on <date> at <time>." followed by the request as JSON. An add-escrow-user request, for example, holds the escrow user's ID, email, name, department, position, and permissions.
  7. Once done, click Close.

Execute a Signed Escrow Certificate​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click the Escrow Certificates in the left panel.
  4. Click the Execute signed certificates button in the top right panel.
  5. In the Apply signed actions dialog, click Browse Files, or drag the files into the box. The box is shown only while the dialog is empty, so select every file you want to apply at once.
  6. Select the signed certificate files from your local machine and click Open. A file can hold a list of certificates, such as the signed-certificates.json that Sign all and download produces, or a single certificate.
  7. Check the certificates listed, then click Apply.
Result: Each certificate shows a check mark as it is applied, and a message reads "Applied N certificates".

Apply applies the certificates in order and stops at the first one the server rejects. That certificate shows the server's error, and the certificates after it are not applied. A certificate file that is not valid JSON shows "Malformed certificate file [name]: invalid JSON", and an entry that is not a signed certificate is skipped with "Skipping malformed certificate".

Refresh Escrow Certificates​

bulk-action

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Escrow section.
  3. Click the Escrow Certificates in the left panel.
  4. Click the Refresh button in the top right panel.

Create an Escrow Deletion Request​

To delete an escrow user, see Escrow Users.

Set Up an Escrow Key for a User​

Requiring a user to escrow their key is not a Sitekey-signed action, and it needs no certificate. A Super-Admin sets it directly in Management:

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Users section.
  3. Click the Users in the top left panel.
  4. Select the user for whom you want to set up an escrow key.
  5. Click the Open full menu button in the top right panel.
  6. Select Change State.
  7. In the dialog, select Active and escrow on next login.
  8. Click Require escrow.
Result: The user's key is escrowed the next time they log in with their usual key file and password.

For the state options and who can set them, see Users.

info

Regular users do not select an escrow group. Enrollment is performed by the user's own client on their next login, against every escrow group that exists at that moment. Selecting a group happens only when an escrow user account is registered.

tip

A Super-Admin can bulk set all new users to Active and escrow on next login during account activation, so that each user's next login enrolls them in escrow, making their key recoverable if they later lose it. The key parts are generated in the user's own session, not by the backend.