Clearing FileWave Client Certs

Clear a FileWave Client certificate when the server must revoke the device's existing identity without deleting its client record—for example, before wiping a Mac or reinstalling an Imaging Virtual Server (IVS) client.

From FileWave Central

For desktop clients, you can right-click the client and choose "Clear Certificate(s)".

The FileWave administrator needs write permission for the selected client and must authenticate the action.

From the Client

Use the client's current certificate to authenticate when both the certificate and its private key still exist on the device:

On macOS, the FileWave Client binary is normally located at /usr/local/bin/fwcld. The examples below use the full path so they can be copied into scripts more reliably.

/usr/local/bin/fwcld -clearCertificate [-serverHost <fwserver_address> -serverPort 20445]

This is the equivalent of the following command using curl (replace <fwserver_address> with the address of your FileWave server):

sudo curl --key /private/var/FileWave/client.key --cert /private/var/FileWave/client.crt -X POST https://<fwserver_address>:20445/auth/client/clear_certificate

After revocation, the client cannot communicate with the server until it creates a new certificate signing request (CSR). A macOS reinstall Fileset can run this command in its activation script so the server clears the old certificate before the reinstalled client requests a new one.

What happens next: Clearing the certificate revokes the existing client identity. It does not reinstall or repair the client by itself. The device must run the FileWave Client again and create a new certificate request before it can communicate with the server. In wipe or reinstall workflows, clear the old certificate before or during the reinstall; if an existing device still cannot check in after clearing, verify the server address and trust settings, then restart or reinstall the client so it can generate and submit a new certificate request.

If the certificate's private key is missing, authenticate with a FileWave application token that has write permission for the client:

/usr/local/bin/fwcld -clearCertificate -token <application_token> [-serverHost <fwserver_address> -serverPort <fwserver_port>]

• <fwserver_address>: The FileWave server address (optional)
• <fwserver_port> : 20445 by default
• <application_token>: A FileWave application token with write permission for this client, available from the Application Tokens tab in Manage Administrators.

Bulk revocation affects every identifier in the request. Use the inventory superadmin token only for an intentional, reviewed list of clients:

curl -X POST https://<fwserver_address>:20445/auth/client/clear_certificates -H 'Authorization: <application_token>' -H 'Content-Type: application/json' -d '["<serial_1>", "<serial_2>", ...]'

The bulk endpoint can identify clients by MAC address or Device ID instead of the default serial number:

curl -X POST https://<fwserver_address>:20445/auth/client/clear_certificates?identifier=mac -H 'Authorization: <application_token_base64>' -H 'Content-Type: application/json' -d '["<mac_address_1>", "<mac_address_2>", ...]'

curl -X POST https://<fwserver_address>:20445/auth/client/clear_certificates?identifier=device_id -H 'Authorization: <application_token_base64>' -H 'Content-Type: application/json' -d '["<device_id_1>", "<device_id_2>", ...]'

The identifier query parameter is optional. Without it, the endpoint matches serial_number.

• <fwserver_address>: The FileWave server address.
• <serial_1>, ...: serial numbers of clients to revoke. Must match the serial_number field from inventory.
• <mac_address_1>, ...: MAC addresses of clients to revoke.
• <device_id_1>, ...: Device IDs of clients to revoke.
• <application_token_base64>: The base64-encoded value of a FileWave application token with write permission for the targeted clients.

The response groups client identifiers under SUCCESS, NOT_FOUND, and ERROR:

• SUCCESS: the client certificate was successfully revoked.
• NOT_FOUND: The server found no matching client certificate. The certificate may already be revoked, the client may not have enrolled yet, the identifier may not match a client, or the client may not have reported the requested MAC address or serial number.
• ERROR: an unexpected error occurred. Please check server logs for details.

Potential log entries

2019-06-12 7:12:02.481|main|FATAL|CLIENT|Unable to retrieve the contents of the cached custom field values: Error decrypting data
2019-06-12 7:12:02.833|main|INFO|CLIENT|CRL updated
2019-06-12 7:12:02.834|main|INFO|CLIENT|No certificate private key yet. Sending a certificate signing request to server my.FQDN.com.
2019-06-12 7:12:03.235|main|FATAL|CLIENT|Failed to send enrollment request (and CSR): error 400 a CSR for this client was already sent.
2019-06-12 7:12:03.235|main|INFO|CLIENT|Falling back to no certificate.