Installing on Windows Server

Tricryption installs on Windows Server 2022 and Windows Server 2025 (x64) from three Windows Installer packages. The qualified builds are listed in the support matrix.

MSI	Installs	Where
tricryption-ks-8.1.<n>-x64.msi	the key server, ks-service.exe, tecert.exe, the key-server provisioner	C:\Program Files\PiSoft\Tricryption\ks\
tricryption-re-8.1.<n>-x64.msi	the remote engine (rE), re-service.exe, its provisioner	C:\Program Files\PiSoft\Tricryption\re\
tricryption-console-gateway-8.1.<n>-x64.msi	the Console and the REST Gateway, the Node.js they are admitted with (24.22.2), the service host, the tier provisioner	C:\Program Files\PiSoft\Tricryption\console-gateway\, ...\node\, ...\service\

The provisioners are installed under C:\Program Files\PiSoft\Tricryption\libexec\. Each MSI installs its release byte for byte and does nothing else: it registers no service and initializes nothing. All state lives under C:\ProgramData\PiSoft\Tricryption\. The MSI creates those folders empty, the provisioners fill them, and no MSI operation ever removes them.

Signed packages

Every MSI, every Windows executable and DLL Pi Soft builds, and the provisioning scripts are Authenticode-signed and timestamped. Before you install, check each MSI: Get-AuthenticodeSignature .\tricryption-ks-8.1.<n>-x64.msi reads Valid with the Pi Soft signer. The FIPS module (ossl-modules\fips.dll) is deliberately left unsigned, so that its integrity check still matches. You can also verify each MSI against the release's signed SHA256SUMS; see Verifying a release.

Prerequisites

• An elevated Windows PowerShell 5.1 session (the one Windows Server ships). The provisioners need neither bash nor Python nor OpenSSL.
• PostgreSQL for the key database, reachable from the key server. Qualified: PostgreSQL 16.15 from EDB's Windows binaries, running as a Windows service under NT AUTHORITY\NetworkService, both over plain TCP and over TLS.
  • A never-touched Windows Server has no Microsoft Visual C++ runtime, and EDB's PostgreSQL binaries need it. In qualification the runtime's three DLLs (msvcp140.dll, vcruntime140.dll, vcruntime140_1.dll) were placed beside PostgreSQL's binaries. The Tricryption MSIs carry their own runtime and need nothing installed.
  • The provisioner can create the key server's database role and database for you, given the PostgreSQL superuser's password in a file. It never installs PostgreSQL.

Both provisioners, tricryption-ks-provision.ps1 and tricryption-tier-provision.ps1, print their usage with -Help, without elevation: a Usage: line, an Options: list and the examples, then exit 0. For example:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\ks\tricryption-ks-provision.ps1' -Help
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\console-gateway\tricryption-tier-provision.ps1' -Help

1. Install the MSIs

From an elevated prompt, in the folder holding the release:

msiexec /i tricryption-ks-8.1.<n>-x64.msi /qn /l*v ks-install.log
msiexec /i tricryption-re-8.1.<n>-x64.msi /qn /l*v re-install.log
msiexec /i tricryption-console-gateway-8.1.<n>-x64.msi /qn /l*v console-gateway-install.log

After the install no Tricryption service exists, nothing listens, and the state folders are empty.

2. Provision the key server

powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\ks\tricryption-ks-provision.ps1' -Instance main -Db <database> -DbRole <role> -DbAdminUser postgres -DbAdminPasswordFile <pg-admin-password-file> -Psql 'C:\Program Files\PostgreSQL\16\bin\psql.exe' -XAuthPolicy

For a database reached over TLS, add the server's address, the CA that issued its certificate and the name on that certificate:

... -DbHost <db-host> -DbSslMode verify-full -DbSslRootCert <db-ca.pem> -DbServerName <db-server-name>

The provisioner creates the role and the database, generates the configuration, runs the key server's setup, and registers instance main as the Windows service TricryptionKS-main. The service starts automatically and headless, and restarts after a failure with no limit. It listens on 127.0.0.1:8893. The instance's configuration, identity and logs are in C:\ProgramData\PiSoft\Tricryption\ks\main\, whose access list admits only the service's account, SYSTEM and Administrators. No password is ever placed on a command line: SQL reaches psql on its standard input and every password travels through the environment.

The master secret is sealed by Windows. By default the instance's master secret is sealed with a machine-bound CNG key into HKLM\Software\PiSoft\kS\Crypto (the remote engine's into HKLM\Software\PiSoft\RE\Crypto), so the service starts with no secret on disk. There is one such slot per product per machine.

3. Provision the Console and the REST Gateway

powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\console-gateway\tricryption-tier-provision.ps1' -SignerCert <signer.pem> -SignerCa <release-ca.pem> -SignerCrl <release-ca.crl.der>

This runs beside key-server instance main. It verifies the installed release against its signature, then sets up the key server's trust anchor and enrols the Gateway's certificate identity (Butler, holding the Administrator role only). It enables the delegation layer, registers the signed release with the key server, and registers and starts both services. To print what is configured, run the same tool with -Readback.

Service	Account	Listens on	Ready when
TricryptionKS-main	NT SERVICE\TricryptionKS-main	127.0.0.1:8893 (TLS)	the listener is the installed ks-service.exe
tricryption-gateway	NT SERVICE\tricryption-gateway	127.0.0.1:18091	GET /api/v1/ready answers 200
tricryption-console	NT SERVICE\tricryption-console	127.0.0.1:18090	GET /api/ready answers 200

The Gateway and the Console run under a service host (WinSW 2.12.0), start delayed-auto and restart after a failure with no limit. Their logs are in C:\ProgramData\PiSoft\Tricryption\console-gateway\logs\. Every start re-checks the installed release against its signed manifest. A changed file makes /api/v1/ready answer 503 and the Gateway's log name the file. A repair restores it (see below).

All services start again on their own after a reboot.

To let users sign in through your OpenID Connect provider, add -OidcConfig <gateway-oidc.json> -PublicOrigin https://<host[:port]> to the same command. The provisioner copies the file into the tier's secrets\ directory and points the Gateway at it. The Gateway then serves its browser login page at /oidc/?provider=<id>&binding=<id> on the public origin. A commented example of the file is C:\Program Files\PiSoft\Tricryption\console-gateway\examples\gateway-oidc.example.json. See OpenID Connect sign-in for the file and the link.

4. Provision the remote engine (optional)

powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\re\tricryption-ks-provision.ps1' -Product re -Instance main -KeyServer 127.0.0.1 -KeyServerPort 8893 -KsAdminPasswordFile 'C:\ProgramData\PiSoft\Tricryption\ks\main\_ADMINPASSWORD_' -Port 5055

This registers TricryptionRE-main as NT SERVICE\TricryptionRE-main, listening on port 5055. Keys stored through the key server can then be fetched through the engine.

Upgrade

Install the newer MSIs over the installed ones, then register the new Console and Gateway release:

msiexec /i tricryption-ks-8.1.<n+1>-x64.msi /qn /l*v ks-upgrade.log
msiexec /i tricryption-re-8.1.<n+1>-x64.msi /qn /l*v re-upgrade.log
msiexec /i tricryption-console-gateway-8.1.<n+1>-x64.msi /qn /l*v console-gateway-upgrade.log
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\console-gateway\tricryption-tier-provision.ps1' -RegisterRelease -SignerCert <signer.pem> -SignerCa <release-ca.pem> -SignerCrl <release-ca.crl.der>

Each upgrade is in place: Windows Installer keeps one product per MSI. The MSI stops this product's running services before replacing files and starts them again afterwards. The configuration in C:\ProgramData\PiSoft\Tricryption\ is not changed. The service accounts, the database and the keys are kept.

If the key server enforces code-signing level 2 (Strict), the upgraded Gateway answers 503 on /api/v1/ready until -RegisterRelease has registered the new release; the registration attests with the release this machine registered before, and the Gateway is admitted within 30 seconds.

Read Upgrading before you upgrade the Console and Gateway tier.

Repair

If an installed file is changed, repair the MSI that owns it:

msiexec /fa tricryption-console-gateway-8.1.<n>-x64.msi /qn /l*v console-gateway-repair.log

The repair stops the product's services, restores every file, and starts the services again, without a reboot.

Remove

msiexec /x tricryption-console-gateway-8.1.<n>-x64.msi /qn /l*v console-gateway-remove.log
msiexec /x tricryption-re-8.1.<n>-x64.msi /qn /l*v re-remove.log
msiexec /x tricryption-ks-8.1.<n>-x64.msi /qn /l*v ks-remove.log

The services are stopped and deleted, and the payload is removed. The state in C:\ProgramData\PiSoft\Tricryption\ and the sealed secrets under HKLM\Software\PiSoft are kept.

Reinstalling after a remove

Installing the MSIs again finds the kept state but registers no service. Bring each instance back from its record, which leaves the configuration, the identity and the database untouched:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\ks\tricryption-ks-provision.ps1' -Instance main -Readback
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\ks\tricryption-ks-provision.ps1' -Instance main -ServiceOnly
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\re\tricryption-ks-provision.ps1' -Product re -Instance main -ServiceOnly
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\console-gateway\tricryption-tier-provision.ps1' -ServiceOnly

Keys stored before the remove unwrap afterwards.

Purge

Purge each provisioned piece first, while the MSIs are still installed, then remove the MSIs:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\console-gateway\tricryption-tier-provision.ps1' -Purge
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\re\tricryption-ks-provision.ps1' -Product re -Instance main -Purge
powershell.exe -NoProfile -ExecutionPolicy Bypass -File 'C:\Program Files\PiSoft\Tricryption\libexec\ks\tricryption-ks-provision.ps1' -Instance main -Purge
msiexec /x tricryption-console-gateway-8.1.<n>-x64.msi /qn /l*v console-gateway-purge.log
msiexec /x tricryption-re-8.1.<n>-x64.msi /qn /l*v re-purge.log
msiexec /x tricryption-ks-8.1.<n>-x64.msi /qn /l*v ks-purge.log

Afterwards no Tricryption service exists, and C:\ProgramData\PiSoft\Tricryption, HKLM\Software\PiSoft and C:\Program Files\PiSoft\Tricryption are gone. The key database is never dropped: it is your data. The machine's CNG key (Tricryption\SystemProtector\v1) is also kept.