Keyfactor Command includes several features that provide different platform capabilities:
-
Command BFF
Hosts the Command BFF service for the Modernized Management Portal. This component is included in preparation for a future release. When OAuth is used for Keyfactor Command authentication, Command BFF handles user authentication and securely brokers requests between the portal and the Keyfactor API
An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command.. -
CA Connector API
Hosts the API used by CA Connector
The Keyfactor CA Connector is installed in the customer environment to provide a connection between a CA and Keyfactor Command when a direct connection is not possible. It is supported on both Windows and Linux and has versions for Microsoft (Windows only) or EJBCA CAs. Clients to communicate with Keyfactor Command and integrated certificate authorities.Optional. Required only if you plan to use CA
A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. Connector Clients. This component is disabled by default.Important: This component requires an instance of RabbitMQ (https://www.rabbitmq.com) to complete the communication from Keyfactor Command to CA Connector Clients and the CAs connected via the CA Connector Client (though RabbitMQ only communicates directly to Keyfactor Command, not the CA Connector Clients). In many cases, this would be a containerized instance. For example:The component uses OAuth for authentication even if you've opted to use Active Directory authentication for the remainder of your Keyfactor Command installation, and therefore requires an OAuth 2.0 compliant implementation. You may choose to install Keycloak if you do not have an alternate provider (see Installing Keycloak).
-
Logi
Hosts the Logi Analytics Platform used to provide Keyfactor Command's legacy dashboards and reports.
If this component is not installed, the legacy dashboard will not be an option. The new dashboard will be shown by default and there will be no option to switch to the legacy dashboard. The legacy reports will not be available.
Optional. Install this component only if you plan to use the legacy dashboard or reporting experience.
-
Management Portal
Hosts the Keyfactor Command web interface used to manage certificates, configure the platform, run reports, and perform administrative tasks.
Required for all Keyfactor Command deployments.
-
Orchestrator Service API
Hosts the services used to communicate with Keyfactor agents and orchestrators for certificate discovery, inventory, and automation.
Optional. Required only if you plan to use agents or orchestrators.
-
Web API
Hosts the Keyfactor Command REST API used by external integrations and applications.
The Keyfactor API is also included with the Management Portal component. This component is made available separately to support hosting the API independently of the Management Portal.
-
Windows Services
Hosts the background services required for Keyfactor Command operation, including the Keyfactor Command service (timer service), which manages scheduled activities such as certificate authority
A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. synchronization, PKI A public key infrastructure (PKI) is a set of roles, policies, and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. monitoring, alerts, report automation, and system maintenance.Required for all Keyfactor Command deployments.
In many Windows server installations, the Keyfactor Command Management Portal, Windows Services, Web API, and Orchestrator Service API roles are collocated on a single server (or pair of servers if redundancy is desired). Both physical and virtual servers are supported.
In Kubernetes installations, containers are created for each of these roles and managed with a Helm chart. Redundancy is handled using Kubernetes clusters.
For a high availability (HA) solution using the same roles on all nodes, note that the following conditions apply:
-
All servers must point to the same Keyfactor Command SQL database.
-
All servers must use the same encryption methodology (see Application-Level Encryption).
-
Keyfactor recommends that the Keyfactor Command Service be configured to run all services on each node. This allows the service to manage the jobs most efficiently—the service will check out jobs via a locking mechanism that will enforce that any jobs are running on only one service at a time. However, you do have the option to manually tune the jobs on the servers if desired (such that server A always does jobs 1, 2 and 3 and server B always does jobs 4, 5 and 6).
-
Review load balancing rules and configuration, if applicable. Load balancing configuration is beyond the scope of this guide.
Keyfactor does not recommend installing any Keyfactor Command components on a CA or on a SQL server in a production environment.
As you plan for Keyfactor Command, you need to decide upon an architecture for the implementation and prepare servers with sufficient resources accordingly. See System Requirements for more information about planning for servers with sufficient resources to support the planned roles.
Licensing
The Keyfactor Command product is licensed by component. Your license for Keyfactor Command may not include all the features described in this guide. If you choose to add additional components to your Keyfactor Command license in the future, these features can generally be configured without the need to reinstall Keyfactor Command.
License files have an extension of cmslicense and are signed to prevent tampering.
Was this page helpful? Provide Feedback