Preparing

This section describes the steps that need to be taken prior to a Keyfactor Command upgrade to complete the prerequisites, create any required supporting components, and gather the necessary information to complete the Keyfactor Command upgrade process.

The following are some key preparation steps that need to be addressed in order to upgrade to version 10.0:

• As of Keyfactor Command version 10.0, by default Keyfactor Command connects to SQL using an encrypted connection using an SSL certificate configured on your SQL server. Customers should acquire and install an SSL certificate for the SQL server before upgrading to Keyfactor Command 10.0 (see the Using SSL to Connect to SQL Server section of the Keyfactor Command Server Installation Guide1 Embedded links to external documents point to the document on the Keyfactor Client Portal. Access to the portal requires a login. See your administrator or your Keyfactor Client Success representative to obtain a login to the portal. ). If you would prefer not to use an encrypted channel for your connection to SQL, see the Configurable SQL Connection Strings section of the Keyfactor Command Server Installation Guide2 Embedded links to external documents point to the document on the Keyfactor Client Portal. Access to the portal requires a login. See your administrator or your Keyfactor Client Success representative to obtain a login to the portal. .
• Upgrade to SQL Server 2016 CU2 or higher and adjust the database compatibility level if needed. For more information, see System Requirements.
• As of Keyfactor Command version 10.0, Windows Server 2016 is no longer supported. The installer will not check your server version nor prevent installation, but the product will not function properly in some instances. Customers should upgrade to Windows Server 2019 or higher before upgrading to Keyfactor Command 10.0. If you choose to use Server 2016, any PFXs will need to be configured to use SHA1 and 3DES for encryption for use by Keyfactor Command.

• If you have any saved certificate collections containing any of the following deprecated certificate search fields, these collections will need to be removed or updated to remove use of these fields that are no longer in version 10:

  • KeyfactorRequestId
  • RequestResolutionDate
  • CARequestId

  These certificate search fields parsers have been removed to allow for native EJBCA support in Keyfactor Command as of v10.

• If you have the CA Policy module v7.0 installed on the same server as the Keyfactor Command Management Portal, you’ll need to upgrade the module to v7.1 before running the Keyfactor Command 10.0 upgrade.
• If you are upgrading from an older version of Keyfactor Command, the installation directory changed, as of Keyfactor Command v9, to C:\Program Files\Keyfactor. Move any scripts or files that are held in the old directory structure to the new location.