1E 9.x (on-premises)

Once you have created the new template on the Certificate Authority (CA), you should issue it. Using the issued template, request a certificate for a target device, and export it in .pfx form and remember the password. The certificate and associated private key should be exported, together with all extended properties, except include all certificates in the certification path if possible and enable certificate privacy.

Installing certificates can be done by using the Keychain Access app, which can be started using either of the following methods:

Install the client certificate

To install a client certificate on each macOS device, follow these steps:

To allow access to the private key follow these steps:

An alternative approach to using the Keychain Access app is to import the .pfx file using the command-line and the security command:

sudo security import <download location>/<macOSpfx>.pfx -k /Library/Keychains/System.keychain -t agg -f pkcs12 -P <password> -T '/Applications/1E.app/Contents/MacOS/1E.Client'

This command imports a client certificate and the associated private key from a .pfx file to a <keychain> as an aggregated type in PKCS #12 format using the specified password and giving access to the 1E Client.

Install the CA certificates

If you experience problems importing certificates using the Keychain Access app, for example if it reports error -25294 and CSSM_CODE_MEMORY_ERROR, an alternative way of importing public certificates and trusting them is to use the security command line tool. For example:

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain <certificate.cer>

Install the 1E Client

To install the macOS 1E Client perform one of the following options :

You will need to use the 1E.Client.updateconf.sh script if you want to reconfigure the client, or you installed 1E Client using the previous installation options.

The pkg installation package for macOS includes a bash script called 1E.Client.updateconf.sh. The configuration properties for the Switch and Background Channel are mandatory, therefore assuming they are on the same 1E Server which has a DNS Name FQDN tachyon.acme.local then the post-installation command line would be similar to the following but all on one command line. The second Switch and Background Channel can be removed if a DMZ server is not used. Single quotes avoid escape characters and are necessary to allow the use of the ; character.

sudo sh '/Library/Application Support/1E/Client/1E.Client.updateconf.sh' 
'/Library/Application Support/1E/Client/1E.Client.conf' 
SWITCH='tachyon.acme.local:4000;tachyon.acme.com:4000' 
BACKGROUNDCHANNELURL='https://tachyon.acme.local:443/Background/;https://tachyon.acme.com:443/Background/'

Please refer to 1E Client configuration settings and installer properties for a list of other configuration properties that can be appended to the above command-line.

To load and start the 1E Client use the command:

sudo launchctl load -w /Library/LaunchDaemons/com.1e.pkg.1E.Client.plist

If it is necessary to stop the 1E Client use the command:

sudo launchctl unload /Library/LaunchDaemons/com.1e.pkg.1E.Client.plist

You will need to use the following Uninstall.sh script if you want to uninstall the client.

sudo sh 'PATH_TO_THE_UNINSTALL_SCRIPT'

#!/bin/sh
# An exit code other than 0 will terminate the installation

sudo pkgutil --forget com.1e.pkg.1E.Client
sudo launchctl unload /Library/LaunchDaemons/com.1e.pkg.1E.Client.plist

LAUNCHDAEMON_PATH=/Library/LaunchDaemons/com.1e.pkg.1E.Client.plist
sudo rm "$LAUNCHDAEMON_PATH"

DOC_PATH=/Library/Documentation/Applications/1E
sudo rm -r "$DOC_PATH"

APP_PATH="/Applications/1E Client.app"
sudo rm -r "$APP_PATH"

currentDir=$(pwd)
DIR="/Library/Application Support/1E/Client"

if [ -d "$DIR" ]; then
  cd "$DIR"
  sudo find . ! -name "1E.Client.conf" ! -name "Persist" ! -name "DBs" ! -name "1E.Client.updateconf.sh" -maxdepth 1 -delete
  cd "$currentDir"
  echo "Retaining config files in ${DIR}..."
  sudo mv "$DIR" "$DIR.retain"
else
  echo "No Configuration found from previous Installation."
fi

exit 0

To upgrade the macOS 1E Client, use one of the following methods:

The -target is the volume mount point, not the path in the file system at which it will be installed.

You must substitute <settings> with actual values agreed with 1E, for example: