Manage Action1 Keys

How to create a new key

You may need to create an Action1 Key in the following cases:

• You are an Enterprise Admin and do not have an Action1 Key yet.
• You need to create an Action1 Key for a newly configured Action1 Enterprise.
• A requested Action1 Key has not been approved, so you want to create a new one to retry the approval.

Use the wizard to create your new Action1 Key as described below. If approval is required, complete both stages. However, if you already have an Action1 Key with the Active status, you can only change it, as described in “How to change your Action1 Key”.

Step 1: Create Your Key

Action1 Deployer is implemented as a management service that runs on a Windows server inside your network, usually on the administrator’s computer or a dedicated server. Action1 Deployer automatically scans your Active Directory to discover workstations and servers that reside in an Active Directory domain or an organizational unit (OU). Having discovered the new computers, it deploys Action1 agents to patch them.

3. By default, your Action1 Key is stored encrypted in Cloud Storage. Action1 generates the Key passphrase automatically. Copy it and store it securely. You will need it to confirm creation of your Action1 Key.

   If you use Local Storage, click Download Action1 Key File. Your Action1 Key will be downloaded as an Action1 Key file in PEM format. Check your Downloads folder to ensure the file is present, then store this file in a separate secure location (not the one where your Key passphrase is stored).

4. Next, you must confirm creation of your Action1 Key: enter the Key passphrase you have copied, then click Confirm. If you use Local Storage, you will need to provide the Action1 Key file first.

Step 2: Get Confirmation code and request Action1 Key approval

This step applies to Action1 Keys that require approval. Before using the new Action1 Key, have it approved by another Enterprise Admin who already has an Active Action1 Key. The approving administrator needs a Confirmation code generated for your key. 

1. Copy the Confirmation code and store it securely.

2. Send it to another Enterprise Admin for approval through a secure channel outside of Action1. You can, for example, send it by Email.

3. Click Finish.

After the new Action1 Key is created, the initiator’s account will be displayed on the My Account and Users & API Credentials pages with the Action1 Key status set to Waiting for approval. See “How to approve a key” for details.

How to approve a key

If you are an Enterprise Admin with an Active Action1 Key, you can approve the new Action1 Keys of other users upon their request.

1. On the Users & API Credentials page, select the user whose Action1 Key status is Waiting for approval.
2. From Actions, select Approve key to start the wizard.
3. Examine the Action1 key information, including the requesting account name, email address, and Action1 Key creation date. Enter the Confirmation code you obtained from the requesting administrator.

4. Next, provide your Key passphrase (if you use Local Storage, also select your Action1 Key file), then click Sign.
5. The Action1 Key status for the requesting user will change to Active, and the Action1 Key can be used to sign protected actions.

How to change a key

You may need to change your Action1 Key, for example, for rotation purposes, or if you lost access to the current passphrase or key, or if either is compromised.

The Key Change wizard replaces your current Action1 Key and generates a new Key passphrase. The procedure depends on whether you still have access to your current Action1 Key.

• If you have access, you can replace the Action1 Key yourself and sign the affected configurations using the new Action1 Key. Follow Scenario A below.
• If you no longer have access, another Enterprise Admin must approve the new Action1 Key before it becomes Active. Affected configurations can be signed again during approval or after activation. Follow Scenario B below.

1. On the My Account page, select Change Action1 Key to start the wizard.
2. Select the reason that matches your situation and follow the corresponding scenario below.

Scenario A: key rotation

1. In the Key Change wizard, select My Action1 Key may be compromised, or I need to rotate my Action1 Key, then click Next Step.

2. On Create New Key, provide your current Key passphrase. If you use Local Storage, also select your current Action1 Key file.
3.  Copy the newly generated Key passphrase and store it securely. Select the checkbox confirming that you have saved it.
4. If you use Local Storage, click Download Action1 Key File and store the new Action1 Key file securely, separately from the new Key passphrase.

5. Click Confirm Key Change.
6. In the Confirm Changing the Key dialog, enter your new Key passphrase. If you use Local Storage, also select your new Action1 Key file. Click Confirm.
7. In the New Signatures Required dialog, review the configurations previously signed with your old Action1 Key. Select the configurations you want to sign again using your new Action1 Key.
8. Click Sign Selected to sign the selected configurations.

Scenario B: lost access

Another Enterprise Admin with an Active Action1 Key must approve your replacement Action1 Key before you can use it.

1. In the Key Change wizard, select I don’t have access to my current Action1 Key, then click Next Step.

2. On Create New Key, copy the generated Key passphrase and store it securely. Action1 cannot recover it if you lose it.
3. Select the checkbox confirming that you have saved the Key passphrase.
4.  Click Download Action1 Key File and store the downloaded Action1 Key file securely, separately from the Key passphrase. Click Next Step.
5.  On Request Key Approval, copy the Confirmation code and send it securely to another Enterprise Admin with an Active Action1 Key. 
6. Have that administrator approve your replacement Action1 Key as described in “How to approve an Action1 Key”.

How to revoke a key

Before you start, consider the following:

• It is strongly recommended to keep at least 2 Enterprise Admins with Active Action1 Keys at all times.
• You cannot revoke your own Action1 Key. To revoke it, ask another Enterprise Admin with an Active Action1 Key to perform the procedure below.
• After revocation, the Action1 Key can no longer be used to sign configurations. You can sign the affected configurations again using your own Action1 Key during the revocation process. Configurations you do not sign will become invalid.

To revoke an Action1 key:

1. In the Users & API Credentials page, select the user whose Action1 Key you want to revoke.
2. From the Actions, select Revoke key, then click Revoke.
3. In the New Signatures Required dialog, review the configurations previously signed with the Action1 Key being revoked. Select the configurations you want to sign again using your own Action1 Key.
4. Click Sign Selected to sign the selected configurations.