Security

The security area brings together everything that protects ThinForge itself: the web certificate, the keys used to provision devices, the signing of updates and a continuous vulnerability scan. You find it in Settings under the Security tab (administrators only).

TLS certificate

Protects the web interface and all connections to the server. After installation a self-signed certificate is active. The status card shows whether the connection is encrypted, plus the name, type, days remaining until expiry (or "Expired"), valid scopes and fingerprint.

Rotate — generates a fresh self-signed certificate with the validity period and host names you choose.
Upload — install your own certificate issued by a certificate authority (certificate and key file in PEM format, key without a passphrase).

Note: After each change the interface is briefly unavailable for a few seconds while the certificate is reloaded. Existing sessions are kept. Rotate in good time before expiry — the card permanently shows the days remaining and flags an expired certificate.

SSH provisioning

ThinForge sets up new devices on their first rollout via a central SSH key. Here you manage this server key and the heartbeat token that devices use to report back to the server.

Generate / Rotate — creates a new key. Devices that are online adopt it automatically the next time they report in (usually within a minute); offline devices pick it up once they are reachable again.
Rotate heartbeat token — issues a new token; devices adopt it automatically on their next report.
History — older keys and tokens are kept for backup and can be deleted individually.

Note: During the brief transition after a rotation, remote maintenance started at the same time on a device may fail. Schedule rotations between two rollout stages, or wait until all online devices have pulled the new key.

Signing key

With the signing key the server signs all device updates so devices can verify their authenticity. You can generate or rotate a key here; existing devices adopt a new key automatically. If the card reports unsigned updates, Sign now fills in the missing signatures.

Note: The provisioning medium (Tools ISO) is not rebuilt automatically when you generate or rotate the key. The current key only lands on it the next time the Tools ISO is rebuilt — which happens automatically the next time the cloning VM starts. So that new installations know the current key, issue the fresh Tools ISO afterwards, distribute the new medium and retire old boot media.

Vulnerability scan

On demand, the scan checks all components of the server for known security vulnerabilities (CVEs) and rates each finding by how reachable the affected component actually is.

Start scan — launches a background run; the interface shows the progress and the time of the last run.
Overview — for critical and high findings you see the raw count and the effective count after rating; medium and low findings are shown as a single total. The goal is zero effective critical and high findings.
Details — for each component you can expand the full list of findings with package, identifier, available fixes and rating.

A finding marked needs review means the automatic rating could not reach a verdict — those cases are reviewed manually by the security team. Run the scan after every update.

SBOMs

For each scan run, software bills of materials (SBOMs) listing the included software are available for download in several standard formats. This is useful for compliance evidence or to archive the state at a given point in time.