XoT-Desktop Client Installation Guide

The XoT-Desktop Client is the end-user application for establishing secure connections to protected devices and networks. It is available for Windows, macOS, and Linux.

Before installing, ensure you have:

Administrator privileges on the machine
A personal .zip configuration package generated by your XMS administrator (unless using the onboarding wizard)
The password for the configuration package (if applicable)

Windows 10/11

Download

Download the .msi installer package from support.xertified.com.

Install

Start the .msi installer and follow the prompts.
If your company uses Microsoft Company Portal, search for XoT Client and select Install.
Alternatively, you can install via command line: msiexec.exe /i <path_to_package> [/quiet][/passive][/q{n|b|r|f}]

Configure

There are two ways to configure the client: using the onboarding wizard or manually with a configuration package.

Option A: Onboarding Wizard

If no configuration is found when starting the XoT Client for the first time, an onboarding wizard will appear. The wizard guides you through:

Authenticating with your XMS via your web browser (OAuth2)
Selecting your token type (software certificate, YubiKey, etc.)
Downloading and importing the configuration automatically

This is the simplest way to get started if your administrator has enabled it.

Option B: Manual Configuration

You need a personal .zip package to configure the XoT Client. This is generated via the XMS and shall be distributed by the administrator.
If no configuration is found when starting the XoT Client, the XoT Client Config application opens. Alternatively, if you need to reconfigure the XoT Client, start the XoT Client Config application.
In the XoT Client Config application, begin by confirming that both Location and Username have been correctly detected. If not, they should be manually adjusted.
Start by selecting "Setup user config", "Import root certificate" and "Setup global config". Upon selecting the latter, the system will prompt the user to elevate its privileges and a dialog should appear requesting to execute the config with administrator rights. Select yes and proceed to enabling the same options as before and click "Apply" to complete the process. If a password is requested, provide the password for the Zip-file.
Provide ample time for the dialogs and confirmation windows to appear. When you are prompted, allow the service to restart, and close the XoT Client Config application. You are now ready to start the XoT Client.

Start

Open the start menu and select the XoT Client.
The connections come up as soon as you have established a connection to the XMS server.

File Locations

Type	Path
Program files	`C:\Program Files\Xertified\XoT Desktop Client`
User configuration	`C:\Users\<username>\AppData\Local\Xertified\`
Global configuration	`C:\ProgramData\Xertified\Config`
User logs	`C:\Users\<username>\AppData\Temp\Xertified\`
System logs	`C:\Windows\Temp\Xertified\`

macOS

Download

Download the .pkg installer package from support.xertified.com.

Install

Double-click the .pkg installer package and follow the installation prompts.
If your company uses Microsoft Company Portal, search for XoT Client and select Install.
Grant any permissions requested during installation (the installer requires administrator privileges).

Configure

You need a personal .zip package to configure the XoT Client. This is generated via the XMS and shall be distributed by the administrator.
Open a terminal and run the configuration script:

sudo /opt/xertified/bin/config-setup.sh --file <path to config.zip> --password <password> --all

The script will import your user certificates, root certificate, and global configuration. If you need to overwrite an existing configuration, add the --overwrite flag.

Alternatively, start the XoT-Desktop Client without configuration to use the onboarding wizard.

Start

Click the XoT-Desktop Client icon in your Applications folder or Launchpad to start.
The connections come up as soon as you have established a connection to the XMS server.

File Locations

Type	Path
Binaries	`/opt/xertified/bin` and `/opt/xertified/lib`
User configuration	`~/.config/xertified/`
Global configuration	`/etc/xertified`
User logs	`~/.config/xertified/logs/`
System logs	`/var/log/xertified/`
Daemon plist	`/Library/LaunchDaemons/com.xertified.xot-daemon.plist`

Troubleshooting

If the "Global config file not valid" error occurs, it is due to an incompatible Client configuration version. Follow this procedure to upgrade your Client config version:
Shut down the XoT-Desktop client.
Run from the terminal:
1. sudo /opt/xertified/bin/config-setup.sh --file <path to config.zip> --password <password> --all --overwrite
2. sudo launchctl unload /Library/LaunchDaemons/com.xertified.xot-daemon.plist && sudo launchctl load /Library/LaunchDaemons/com.xertified.xot-daemon.plist
You are now ready to start the XoT-Desktop client.

Linux

Download

Download the appropriate installer packages from support.xertified.com:
.deb package set (xot-daemon, xot-headless, and xot-client) for Debian-based distributions (Ubuntu, Debian)
.rpm package set (xot-daemon, xot-headless, and xot-client) for Red Hat-based distributions (RHEL 9+, Fedora)

Both x86_64 and ARM64 architectures are supported.

Install

For Debian/Ubuntu:

sudo dpkg -i \
  xot-daemon_<version>-<release>_<arch>.deb \
  xot-headless_<version>-<release>_<arch>.deb \
  xot-client_<version>-<release>_<arch>.deb

If there are missing dependencies, resolve them with:

sudo apt-get install -f

For RHEL/Fedora:

sudo rpm -i \
  xot-daemon-<version>-<release>.<arch>.rpm \
  xot-headless-<version>-<release>.<arch>.rpm \
  xot-client-<version>-<release>.<arch>.rpm

Note for Ubuntu 24.04: Due to an AppArmor restriction, you may need to set kernel.apparmor_restrict_unprivileged_userns=0 for the client's IPC to function correctly.

Configure

You need a personal .zip package to configure the XoT Client. This is generated via the XMS and shall be distributed by the administrator.
Run the configuration script:

sudo /opt/xertified/bin/config-setup.sh --file <path to config.zip> --password <password> --all

To overwrite an existing configuration, add --overwrite:

sudo /opt/xertified/bin/config-setup.sh --file <path to config.zip> --password <password> --all --overwrite

Alternatively, start the XoT-Desktop Client without configuration to use the onboarding wizard.

Start

Launch the XoT-Desktop Client from your application menu, or run it from the terminal.
The connections come up as soon as you have established a connection to the XMS server.

Note: System tray support requires a KDE, GNOME, or Unity desktop environment.

File Locations

Type	Path
Binaries	`/opt/xertified/bin` and `/opt/xertified/lib`
User configuration	`~/.config/xertified/`
Global configuration	`/etc/xertified`
User logs	`~/.config/xertified/logs/`
System logs	`/var/log/xertified/`
Daemon service	`/lib/systemd/system/xot-daemon.service`

Headless Mode

For servers and automated environments where no graphical interface is needed, the XoT-Desktop Client can run in headless mode as a system service. This provides the same secure connectivity as the desktop version, making it suitable for always-on tunnels and machine-to-machine communication.

Setup

Configure the client using the config-setup.sh script as described above for macOS or Linux.
Enable and start the headless service:

sudo systemctl enable xot-headless
sudo systemctl start xot-headless

Limitations

No GUI — runs entirely as a background service.
No YubiKey support — PIN prompting is not possible without a GUI. Use software tokens (PEM files), NetID, or OpenSC tokens instead.
Runs as service account — uses the xertified user on Linux, or NT AUTHORITY\NETWORK SERVICE on Windows.

General Troubleshooting

Installation Fails

Verify that you have administrator privileges on the machine.
Remove any previous version of the XoT Client before installing a new one.
Ensure your operating system meets the minimum requirements.

Configuration Import Errors

Ensure the .zip configuration file has not been corrupted during transfer.
Copy the configuration file to a local drive before importing (avoid importing from network drives or USB devices that may disconnect).
Verify that the password is correct.
If reconfiguring, use the --overwrite flag (macOS/Linux) or re-run the XoT Client Config application (Windows).

Client Cannot Connect After Configuration

Verify that your machine has internet access.
Check that no firewall or antivirus software is blocking the XoT Client.
Ensure that no other VPN software is interfering with the connection.
Verify that NTP time synchronization is active on your machine:
Windows: Ensure W32Time or TimeBrokerSvc service is running.
macOS: Ensure timed is running (sudo sntp -sS time.apple.com to force sync).
Linux: Ensure systemd-timesyncd or chrony is active.
If the issue persists, use the log collection tool in the XoT-Desktop Client support menu to gather diagnostic information for your administrator.

Daemon Service Is Not Running

The XoT-Desktop Client requires the xot-daemon service to be running for network configuration (WireGuard tunnels, routes). If connections appear but traffic does not flow:

Windows: Check the xot-daemon service in the Services management console.
macOS: sudo launchctl list | grep xertified
Linux: sudo systemctl status xot-daemon

Restart the service if needed:

Windows: Restart the xot-daemon service from the Services management console.
macOS: sudo launchctl unload /Library/LaunchDaemons/com.xertified.xot-daemon.plist && sudo launchctl load /Library/LaunchDaemons/com.xertified.xot-daemon.plist
Linux: sudo systemctl restart xot-daemon