Certificates for secure connection through the API

Client applications that connect to Kaspersky Industrial CyberSecurity for Networks Server through the API establish a secure connection using client certificates and the gRPC server certificate.

During the application installation process, the following keys and certificates are created:

• gRPC server certificate (the file named product_facade_grpc_server.crt).

  This certificate is used by client applications for Server authentication. The Server uses this certificate to establish a connection with client nodes.

• Root certificate of the gRPC server (the file named product_facade_grpc_ca.crt).

  This certificate is used by the administrator to create client certificates. Client applications use this certificate to confirm the authenticity of their certificates (as part of the certificate chain).

• Private key of the gRPC server (the file product_facade_grpc_ca.key).

  This private key is used by the administrator to create client certificates.

By default, the specified files are located in the folder /var/opt/kaspersky/kics4net/public_certs/. Access to this folder is granted to a user with root privileges as well as to users of the kics4net group.

To connect to the gRPC server, the client application must use the following certificates and keys:

• gRPC server certificate (the file named product_facade_grpc_server.crt).

  This certificate, which is created during installation of the application, is required for Server authentication.

• Certificate chain (the file client.crt).

  This certificate chain is used by the client application for authentication. The certificate chain includes a client certificate authenticated by the root certificate of the gRPC server, and the chain of certificates up to the root certificate of the gRPC server.

• Private key of the client (the file client.key).

  This private key is used by the client application during authentication.

The administrator must create certificates and keys to be used by client applications (hereinafter also referred to as "client certificates"). Each client certificate must be created in the name of the computer that will connect to the Kaspersky Industrial CyberSecurity for Networks Server through the API.

For information on using client certificates to establish a connection with the Kaspersky Industrial CyberSecurity for Networks Server through the API, please refer to the documentation for the Kaspersky Industrial CyberSecurity for Networks API.

Page top