Skip to main content

Decryption Keys for PingCastle Enterprise

PingCastle.exe agents can encrypt reports with --encrypt before sending them, using an RSA key pair, so reports aren't exposed in plain text in transit or in email. See Report Encryption for how to generate that key pair and configure an agent to encrypt with it.

PingCastle Enterprise needs the matching private key to decrypt those reports when it receives them. Manage this key at Configuration > Decryption.

warning

The default PingCastle decryption key is insecure, and newer versions of PingCastle no longer provide it. Generate your own key pair and configure it in both PingCastle Enterprise and the agent's appsettings.console.json file.

To set up decryption:

  1. Generate an RSA key pair on an agent using PingCastle.exe --generate-key. See Report Encryption for the full command output and JSON structure.
  2. In PingCastle Enterprise, go to Configuration > Decryption and add the private key.
  3. Add the matching public key to the appsettings.console.json file of every agent that should encrypt reports with this key.

Reports uploaded without encryption import normally, because decryption applies only to reports encrypted with --encrypt. If an agent encrypts a report with a key PingCastle Enterprise doesn't have, decryption fails and the import fails.