Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.

Multiexcerpt include
PageWithExcerptDesign Considerations



Information that will help you design and plan the implementation of Tachyon in your organization. This includes all the prerequisites and dependencies, which are necessary to install 1E Client with Tachyon client enabled.

For a full understanding of Tachyon features and their configuration please refer to Tachyon 5.1 documentation.


Tachyon client features are not required if the 1E Client is being installed only to support Nomad, PXE Everywhere, Shopping, or WakeUp.

Advanced Panelboxes for Confluence
titleOn this page:

Table of Contents
excludeSummary|On this page|In this section...

Public Key Infrastructure

Tachyon features require a PKI and certificates on client devices and servers. Please see below for client requirements, and Tachyon 5.1 - Requirements: Certificates for server requirements.



You need to have a PKI in your environment with at least one Issuing CA.

Tachyon requires each Issuing CA has:

  • Certificate Revocation List (CRL) Distribution Point (CDP) that uses HTTP/S 
  • this HTTP/S CDP information is included in certificates issued to Tachyon Server and client devices


titlePKI notes

If you have an existing PKI and have just added a new CDP to support HTTP/S then you will need to re-issue certificates to your servers and devices.

Tachyon deliberately does not work with self-signed certificates for security reasons. Therefore Tachyon client or Server cannot be installed on the same server as a Root CA, because its certificate is self-signed.

Tachyon uses TLSv1.2. If your PKI is using SHA512 then please ensure that your environment has relevant updates applied, as described in KB2973337. See Client issues: Enabling SHA-512 to work with TLSv1.2.

If you want Tachyon to manage legacy OS that Microsoft no longer supports there may be issues with encrypted certificates described in Requirements: Constraints of Legacy OS.

Client Certificates


If you have configured Tachyon Server to require client certificates, then each device requires a certificate with the following properties so the Tachyon client can be authenticated by the Tachyon Switch.

Client certificates must meet the following requirements:

  • Issued by a trusted Certificate Authority (CA)
    • The certificate for the Root CA in the Certification Path must exist in the Trusted Root CA store of the client
    • If the issuing CA is not the Root CA then the certificate for the issuing CA and any intermediate CA in the Certification Path must exist in the Intermediate CA store of the client
    • If either of these CA certificates are different to those used by the Tachyon Web Server, they will need to be exported and imported on the Tachyon Web Server
    • Most organizations have automated distribution of these CA certificates to clients and servers, using Group Policy for example.
  • Has at least the following Enhanced Key Usage
    • Client Authentication
  • Revocation information is included.
    • References at least one CRL Distribution point that uses HTTP.
  • Has a Subject Name of type Common Name (CN=<hostname>) or Subject Alternative Name (DNS Name=<hostname>) where <hostname> depends on the type of device:
    • On domain-joined Windows PCs this must be the hostname FQDN of the computer, for example W701.ACME.LOCAL
    • On workgroup Windows PCs and non-Windows devices, this must be the hostname of the computer - as returned by the hostname command, for example on Windows PC this could be W701, and on a Mac this could be MAC01.local
  • Has a private key
    • For workgroup Windows and non-Windows devices, this must be exportable


The client device's certificate is stored differently depending on the type of OS.

  • For Windows devices, the certificate is stored in the Windows Local Computer personal certificates store. 
  • For non-Windows devices, except for the Mac, the Tachyon client does not use proprietary certificate stores. Instead, the client requires the certificate exists as a .pfx file in the client installation folder structure:
  • For macOS, you have a choice of storing the client certificate in the macOS Key Store or using the .pfx file approach required by other non-Windows devices.


If using a Microsoft Enterprise CA then the following should be considered.

  • For domain joined Windows computers:
    • use the Computer template or a duplicate,
    • enable auto-enrollment - so that devices enroll automatically.
  • For workgroup Windows and non-Windows devices:
    • use a duplicate or equivalent of the Computer or Workstation template,
    • the template's Subject Name uses supply in the request - so the hostname can be entered when requesting a certificate,
    • the template must Allow private key to be exported - so a certificate can be requested on a domain joined Windows computer, exported as a .pfx file and then imported on the target device (see non-Windows Device Certificate).

If using a standalone CA, then certificates must be deployed by other means.

Tachyon integration with Nomad

Downloading Agent Resources
Downloading Agent Resources

Tachyon integration with Nomad allows Tachyon to make use of Nomad features for more efficient downloading of content from different sources including the Tachyon Background Channel. Using this feature needs the following settings enabled, you can do this during the 1E Client installation:

  • Nomad client module - enabled (off by default)
  • Tachyon integration with Nomad - enabled (on by default)

With the Nomad integration feature enabled, Tachyon client will detect if the Nomad module of 1E Client is enabled and automatically use it to download content from Tachyon Background Channel servers.

Tachyon's use of Nomad works irrespective of whether Nomad is integrated with Configuration Manager, or using ActiveEfficiency features.


Configuration Manager is not a prerequisite for Tachyon integration with Nomad, but you will need to consider the following:

Configuration Manager client present

You do not need to make any configuration changes to Nomad for it to integrate with Tachyon, other than enable the Nomad client module in the 1E Client, or have a legacy version of the Nomad client installed. Please refer to Nomad 7.0.200 documentation for guidance on designing and deploying Nomad.

Configuration Manager client not present

You must ensure the following bits are enabled in the relevant Nomad installer properties and their corresponding registry values. These are enabled by default in the Nomad client module of the 1E Client. You must set these bits if you configure either of the following properties:

  • CompatibilityFlags bit 1 - enable long hashes
  • SpecialNetShare bit 13 - enable HTTP(S)


If you have any configuration baselines or other policies that control Nomad settings then these will need to be reviewed. Review is especially important if you have upgraded from legacy Nomad Branch 6.x where these bits were disabled by default.

Tachyon scripting requirements


Agent scripting requirements
Agent scripting requirements
Tachyon real-time instructions are written in the Tachyon native language SCALE, which is very like SQL but with additional logic, functions and methods. Scripts can be downloaded when an instruction runs, or actual command text embedded in the instruction. You will very probably want to use scripts in the instructions you download from 1E or instructions you write yourself. Therefore, you must ensure the appropriate scripting environment is present on Agent devices.

Windows Tachyon clients can use PowerShell scripts. Ensure your Tachyon client devices have an appropriate version of PowerShell installed to support any custom scripts you may develop. See PowerShell on Windows OS.

Non-Windows Tachyon clients can use bash as their scripting medium. This should be present on all non-Windows Tachyon client devices.

For more information about SCALE and writing your own instructions, please refer to:



Multiexcerpt include
PageWithExcerptSupported Platforms

Bash and Perl

Multiexcerpt include
PageWithExcerptSupported Platforms

Requirements for verifying the Tachyon installation

The Verifying page provides detailed steps for verifying a new or upgraded infrastructure, including firsts steps for uploading and running instructions. Below is a list of requirements to perform verification testing.

Multiexcerpt include

Firewall ports

Please refer to Tachyon communication ports.