Keys and Certificates are used to secure the communication between two entities. In a NoMachine infrastructure, communications are established between:

All these communications channel are encrypted and protected by Certificates or pairwise Keys provided with the NoMachine installation. If you may wish to replace any of them with your own Keys and Certificates, please follow instructions in the next sections.

TIPS
I	All instructions are intended to be run from console and require an account with administrative privileges: 'root' on Linux and Mac (use a 'sudo' user if you don't have the 'root' account on your system and and add the sudo prefix to all commands) and an administrator user on Windows. On Windows, execute the CMD shell as administrator.
II	Instructions use the NoMachine nxkeygen tool, as an alternative, you can use the standard ssh-keygen command from OpenSSH.
III	By default, keys and certificates are generated with 2048 bit lenght, specify the -n option for a different lenght.
III	Instructions refers to installation directory which is the installation directory of the NoMachine server, by default: /usr/NX on Linux /Applications/NoMachine.app/Contents/Frameworks/ on Mac /C:\PROGRA~1\NoMachine on Windows, i.e. C:\Program Files (x86)\NoMachine on 64bit systems or C:\Program Files\NoMachine on 32bit systems.

The nxd program is the NoMachine Network Daemon resident on the server host (any of the NoMachine servers and the Terminal Server Node) necessary to accept connections through NX protocol. Its SSL certificate is made of:
installation directory/etc/keys/host/nx_host_rsa_key.crt
installation directory/etc/keys/host/nx_host_rsa_key

CA certificates will be supported with the implementation of https://www.nomachine.com/FR02L02810.

How to generate and use a new certificate and private key
STEP 1- generate a new certificate and private key for nxd. The general format of the is:

Restarting nxd is not necessary.

STEP 2- For web sessions it's necessary to update the client.crt by adding content of the new certificate nx_host_rsa_key.crt.

The certificate is:
/var/NX/nxhtd/.nx/config/client.crt on Linux
/Library/Application\ Support/NoMachine/var/nxhtd/.nx/config/client.crt on Mac
C:\ProgramData\NoMachine\nxhtd\.nx\config\client.crt on Windows.

For example on Linux, if the new certificate is placed in /usr/NX:

Both entries for Host:localhost and Host:127.0.0.1 must be present in client.crt which should look like:
Host:localhost
-----BEGIN CERTIFICATE-----
MIIC9zCCAd+gAwIBAgIRAP4YLqSxLm9xey/k41vmu+cwDQYJKoZIhvcNAQEFBQAw
(......)
-----END CERTIFICATE-----
Host:127.0.0.1
-----BEGIN CERTIFICATE-----
MIIC9zCCAd+gAwIBAgIRAP4YLqSxLm9xey/k41vmu+cwDQYJKoZIhvcNAQEFBQAw
(....)
-----END CERTIFICATE-----

The nxhtd program is the NoMachine Apache-based web server included in any of the NoMachine server installations (except NoMachine free) and necessary for accepting connections by the web. In case of multi-node environments (Enterprise Terminal Server + Terminal Server Nodes) it's provided by the Enterprise Terminal Server and it's not installed on the remote nodes.

Installation comes with a self-signed a SSL Certificate File and SSL Certificate Key file intended to be just a sample. They are respectively, for default installation path:
Linux
/usr/NX/etc/keys/host/ht_host_rsa_key.crt
/usr/NX/etc/keys/host/ht_host_rsa_key
macOS
/Applications/NoMachine.app/Contents/Frameworks/etc/keys/host/ht_host_rsa_key.crt
/Applications/NoMachine.app/Contents/Frameworks/etc/keys/host/ht_host_rsa_key
Windows 64bit
C:\Program files (x86)\NoMachine\etc\ht_host_rsa_key.crt
C:\Program files (x86)\NoMachine\etc\keys\host\ht_host_rsa_key

Administrators have to replace the sample SSL Certificate File and Key File with their own certificate self-signed or acquired from a CA.

How to generate a new (self-signed) certificate and apply it
The general format of the command to generate a new certificate and private key for nxhtd is:

Let's assume to create new self-signed certificates named 'new_ht_host_rsa_key' and 'new_ht_host_rsa_key.crt'.

On Linux
STEP 1 - Generate the certificate
Execute from a command line in a terminal:

STEP 2 - Edit the nxhtd configuration file
Open: /usr/NX/etc/htd.cfg
and set:
SSLCertificateFile "/usr/NX/etc/keys/host/new_ht_host_rsa_key.crt"
SSLCertificateKeyFile "/usr/NX/etc/keys/host/new_ht_host_rsa_key"

STEP 3 - Update certificate permissions
Move to /usr/NX/etc/keys/host/ and execute:

STEP 4 - Restart nxhtd
You can restart nxhtd from the NoMachine Server preferences UI or by command line:

On macOS
STEP 1 - Generate the certificate
Execute in a terminal:

STEP 2 - Edit the nxhtd configuration file
Open: /Applications/NoMachine.app/Contents/Frameworks/etc/htd.cfg
and set:
SSLCertificateFile "/Applications/NoMachine.app/Contents/Frameworks/etc/keys/host/new_ht_host_rsa_key.crt"
SSLCertificateKeyFile "/Applications/NoMachine.app/Contents/Frameworks/etc/keys/host/new_ht_host_rsa_key"

STEP 3 - Update certificate permissions
Move to /usr/NX/etc/keys/host/ and execute:

STEP 4 - Restart nxhtd
You can restart nxhtd from the NoMachine Server preferences UI or by command line:

On Windows
STEP 1 - Generate the certificate
Execute in a CMD console launched as administrator:

STEP 2 - Edit the nxhtd configuration file
Open: C:\Program files (x86)\NoMachine\etc\htd.cfg
and set:
SSLCertificateFile "C:\Program files (x86)\NoMachine\etc\keys\host\new_ht_host_rsa_key.crt"
SSLCertificateKeyFile "C:\Program files (x86)\NoMachine\etc\keys\host\new_ht_host_rsa_key"

STEP 3 - Restart nxhtd
You can restart nxhtd from the NoMachine Server preferences UI or by command line:

The nxsshd program is the NoMachine SSH server installed on Windows by any of the enterprise packages (NoMachine free doesn't have it). It's necessary to accept connections through the SSH protocol.

Its RSA keys are:
installation directory/etc/keys/host/ssh_host_rsa_key
installation directory/etc/keys/host/ssh_host_rsa_key.pub

How to generate a new certificate
To generate a new SSH key pair, run from the CMD console:

How to use the new certificate
STEP 1- Configure nxsshd to use a different private key by editing this file:
installation directory/etc/sshd_config

Uncomment and set te proper value for the HostKey configuration key.

For example, if the RSA key is placed at: "C:\Program Files (x86)\NoMachine\etc\keys\host\new_ssh_host_rsa_key":
- edit the sshd_config file
- uncomment the '#HostKey /etc/ssh/ssh_host_rsa_key' entry (i.e. remove '#')
- and change this key to the appropriate value:
HostKey "C:\Program Files (x86)\NoMachine\etc\keys\host\new_ssh_host_rsa_key"

STEP 2- Then, it's necessary to restart nxsshd. This can be easily done via the NoMachine Server preferences GUI.

TIP

The public key must be stored with the same file name of the private key but with .pub as postfix. For example, if the new private key is new_rsa_key, the public key must be named as new_rsa_key.pub

NoMachine Enterprise Terminal Server authenticates on the Terminal Server Node with a RSA key pair. This RSA key pair is generated during the installation and its server specific. This means that if the node is added to a different server, also the RSA key pair will be different.

This key pair is made of:
installation directory/etc/keys/node.localhost.id_rsa
installation directory/etc/keys/node.localhost.id_rsa.pub

When adding the node to the server (by means of 'nxserver --nodeadd' command), the public part of the key pair is automatically added to the remote node.

The RSA key is deleted from the node when the node is removed from the list (with the 'nxserver --nodedel' command).

The 'nxserver --nodeupdate NODENAME:PORT' command will add the new key (if set on the main server host) on the node, but it will not remove the old key.

To adopt a custom key pair for server-node authentication, follow all steps below. If not otherwise specified, commands are intended to be run on the Enterprise Terminal Server host.

STEP 1- Generate a new RSA key pair and name the keys as node.localhost.id_rsa and node.localhost.id_rsa.pub (i.e. the new keys must have the same name of the original ones):

Then ensure that proper permissions and ownership are set:

STEP 2- Stop the server to prevent users from starting new sessions while replacing the server public key on the nodes. This will not terminate running sessions:

STEP 3- Make a backup of the original RSA keys on the server machine in installation directory/etc/keys.

STEP 4- Place the new RSA key pair in the same directory, installation directory/etc/keys.

STEP 5- Propagate the new RSA sever public key on the node by running:

The 'nxserver --nodeupdate' command will not remove the old key on the node. To remove it, delete the node:

As an alternative, it's possible to execute a manual procedure to remove the old RSA public key(*) and add the new one (**) on the remote Terminal Server Node.

STEP 6- Only if you have two NoMachine servers in a failover cluster, update the cluster configuration to synchronize the new RSA key pair. Run on the primary or on the secondary server the following command:

The failover cluster uses (i) a SSH key pair to authenticate each other the primary and secondary server and (ii) a SSL certificate on the shared IP to avoid users having to accept again the server host fingerprint when the failover occurs.

(i) How to generate and use a new SSH key pair for the primary-secondary server authentication

You can generate a new SSH key pair on the primary server host. Name the new keys as the original ones:

Then ensure that the new keys have proper permissions and ownership. For example on Linux:

How to use the new key-pair
Propagate the new key to the secondary server by running on the primary server the following command:

(ii) How to generate and use a new SSL certificate and private key on cluster shared IP

The SSL certificate used for connections by NX protocol when the failover cluster is set-up is made of:

To generate a new certificate and key:

Then ensure that the new keys have proper permissions and ownership. On Linux they should look like:

-rw------- 1 nx root 1675 2013-11-18 12:18 nx_cluster_rsa_key
-rw-r--r-- 1 nx root 1090 2013-11-18 12:18 nx_cluster_rsa_key.crt

and on Mac:

-rw------- 1 nx wheel 1679 Apr 8 16:21 nx_cluster_rsa_key
-rw-r--r-- 1 nx wheel 1090 Apr 8 16:21 nx_cluster_rsa_key.crt

How to use the new certificate
Propagate the new certificate to the secondary server by running on the primary server the following command:

NoMachine Cloud Server authenticates on any of the federated servers with a RSA key pair. This RSA key pair is generated during the installation and its server specific. This means that if the server is added to a different Cloud Server, also the RSA key pair will be different.

This key pair is made of:
installation directory/etc/keys/node.localhost.id_rsa
installation directory/etc/keys/node.localhost.id_rsa.pub

When adding a server to the Cloud Server (by means of 'nxserver --serveradd' command), the public part of the key pair is automatically added to the remote server host.

The RSA key is deleted from the server host when the server is removed from the multi-server environment (with the 'nxserver --serverdel' command).

The 'nxserver --serverupdate SERVERNAME:PORT' command will add the new key (if set on the Cloud Server host) on the server, but it will not remove the old key.

To adopt a custom key pair for the authentication, follow steps below.

Instructions apply to Cloud server and its first-level servers. If the Cloud Server is a sub-level server, be sure to execute instructions on its host and not on the main Cloud Server.

STEP 1- Make a backup of the original RSA keys on the Cloud Server machine in installation directory/etc/keys.

STEP 2- Generate a RSA key pair and name keys as node.localhost.id_rsa and node.localhost.id_rsa:

Ensure also that the new keys have proper permissions and ownership, as the original ones.

STEP 3- Stop the Cloud Server to prevent users from starting new sessions while replacing the server public key on the federate servers. This will not terminate running sessions.

STEP 4- Place the new RSA key pair in the same directory, installation directory/etc/keys.

STEP 5- Propagate the new RSA sever public key on the federated server by executing on the Cloud Server host:

Note that this command will not remove the old key on the federated server. To remove it, delete the server:

As an alternative, it's possible to execute a manual procedure to remove the old RSA public key (*) and add the new one (**) on the federated server.

STEP 6- Only if you have two Cloud Servers in a failover cluster, update the cluster configuration to synchronize the new RSA key pair. Run on the primary or on the secondary server the following command: