Community Archive (Customer) asked a question.

February 25, 2016 at 7:52 PM
Upgrade PGP Concern
Greetings, If we upgrade from 8.1, to 9.0, will there be any change to the PGP requirements or engine?  When we moved to 8.1, there was an internal engine upgrade, which broke a number of our tasks.  The engine required that our 3rd party partners upgrade their PGP software, in order to be able to generate keys which the new 8.1 would accept.  We cannot force our partners to make those upgrades.  We were forced to roll back to a previous PGP engine, in order to maintain our existing transfers with those partners using the older engines.
  • 18 answers
  • 165 views

  • Community Archive (Customer)

    What John said..
    I'm upgrading this weekend and would like to know this too. Guess I'll submit ticket too.

  • Community Archive (Customer)

    We are also in the middle of an upgrade from Central version 8.0.2.10 to 9.0.
    Currently, we have many of our vendors public keys in the current environment (8.0), configured as"Key Format: DSS". Do you know if it is true that we will NOT have any issues when we upgrade to 9.0, or do we have to also go back to the old PGP Module for version 8.0 when we upgrade? Is it true that the ONLY formats that have issues in version 9.0 is "DSA" or "RSA-legacy"??
    Also, I saw the earlier post by Bill Murphy relating to this....just wanted to make sure it is true?? I have attached an example of a key

  • Community Archive (Customer)

    The KB article sounds like DSS is only an issue when trying to gen new DSS keys, but not if you have old DSS keys. I have not really heard anything about the new module not being able to decrypt with old keys.
    Just got off phone with support and he made it sound like there could be issues if I have old keys in the keyring. Basically suggested I downgrade the PGP module as soon as I upgrade. Sounds like all the old keys should still be there after the upgrade and to restore if needed after the downgrade.
    Taking manual and automatic backups of all my keys now

  • Community Archive (Customer)

    The default PGP engine in MOVEit Central 9.0 is the same engine as in 8.1 and will not support some of the very old legacy PGP keys.  You can still swap back to the old engine in Central 9.0 the same as you did in 8.1.

  • Community Archive (Customer)

    Thank you Bill. I appreciate the feedback. I will check with our vendor to see if that works for them. Thanks.

  • Community Archive (Customer)

    John,
    Since you're already running with 8.1 and have not experienced issues with PGP I think you'll be OK doing an in-place upgrade to 9.0. 
    The PGP engine has problems with PGP keys that are formatted as "DSA" or "RSA-legacy". This information can be seen when you view PGP keys in the Central Admin under "Key Format".  If you have any keys in that format you should plan to use this KB to switch back to the old engine: 
    http://ipswitchft.force.com/kb#!/article/PGP-Changes-in-Central-8-1/pgp

  • Community Archive (Customer)

    John,
    PGP keys in very old formats will not import or be recognized by the 8.1/9.0 PGP key engine.
    If you had old PGP keys that did not import into 8.1 and you had to rollback to the 8.0 PGP engine you will need to do the same procedure after installing 9.0 to use the 8.0 PGP engine.
    If you are running out-of-the-box 8.1 then you should not need any special steps when you upgrade to 9.0.

  • Community Archive (Customer)

    is there any risk to existing PGP keys, going from 8.1 to 9? or is it just creating/importing new keys that's the issue? how would this issue manifest itself? would I see errors somewhere?
10 of 18