Synchronizing Print Deploy security keys across multiple servers (v1.10.4437 or later)

Print Deploy v1.10.4437 introduces enhanced security for the client auto-update mechanism. If you run multiple Print Deploy servers in a load-balanced or high-availability environment, you must manually synchronize the newly generated key pairs (a public and private key) across all servers to maintain client connectivity.

Step 1: Locate the master key pair files on one of the Print Deploy servers

1. Log into one of your Print Deploy servers (this will act as the source). Navigate to the data directory matching your server’s Operating System:
   • Windows: [app-path]\providers\print-deploy\win\data\
   • macOS: [app-path]/providers/print-deploy/mac/data/
   • Linux: [app-path]/providers/print-deploy/linux/data/

1. Locate the two newly generated key files: updater.key and updater.pub.

Step 2: Back up the key pair

Copy updater.key and updater.pub to a secure, separate backup location.

Note: Keep this backup safe. If you ever restore a Print Deploy server from an older backup, you must re-apply these exact keys to preserve the secure auto-update connection with existing clients.

Step 3: Copy the keys to the other Print Deploy servers

(Make sure this is done using restricted administrator permissions)

Using an account with restricted administrative privileges (such as local SYSTEM for Windows or root for macOS/Linux), copy the updater.key and updater.pub files from your source server. Paste them into the identical data directory on every other Print Deploy server in your environment, replacing any existing files of the same name.

Step 4: Secure file permissions

On each Print Deploy server, verify that the file permissions are tightly restricted to prevent unauthorized access:

For Windows:

• updater.key (Private Key): Must only be accessible by the local SYSTEM account
• updater.pub (Public Key): Write access must be restricted to SYSTEM / root, but it can remain readable by all users.

For macOS/Linux:

• updater.key (Private Key): ‘read & write’ access must only be accessible by the ‘papercut’ user (the file owner). No access is allowed to any other user or group.
• updater.pub (Public Key): ‘read & write’ access must only be accessible by the ‘papercut’ user (the file owner). “Read only” access is allowed to other users and groups.
  

Step 5: Restart the Print Deploy service

Restart the PaperCut Print Deploy Server service on all updated servers to load the newly synchronized key pairs into memory.

Troubleshooting

Error: Client installer is not available for download: updater key pair may be misconfigured

You can fix this error quickly! This issue occurs when your updater.key and updater.pub files get corrupted during an upgrade. It usually happens when your data directory lives on a network share.

Check your key files first to confirm corruption. Corrupted files are under 100 bytes, lack standard text formatting, and contain broken keys. You can easily force Print Deploy to generate fresh keys.

Resolution Steps

1. In your services manager, stop the PaperCut Print Deploy Server service.
2. In the data directory, move updater.key and updater.pub to a safe backup folder.
3. In your services manager, restart the PaperCut Print Deploy Server service.
4. Across your remaining servers, synchronize these newly generated keys.