Certificate Management

Certificate Management (mTLS)

RAVEN supports Mutual TLS (mTLS) to authenticate agents against the C2 server using PKCS12 keystores. This page covers the full certificate lifecycle: CA → Server → Agent.

Why mTLS?

Standard TLS only verifies the server's identity to the client. Mutual TLS additionally requires every connecting agent to present a valid client certificate signed by your own Certificate Authority (CA), preventing unauthorized or rogue connections to your C2 listener.

Step 1 — Initialize CA and Server Certificate

Before anything else, initialize your local Certificate Authority and the server's own certificate:

java -jar target/raven.jar --init-certs

This generates the root CA and the server keystore used to terminate TLS connections.

Step 2 — Generate Agent Certificates

Once the CA exists, you can issue client certificates for individual agents.

Single Agent

java -jar target/raven.jar \
  -a myagent -ah 192.168.1.10 -ap 4444 -am

Flag	Meaning
-a myagent	Agent identifier/name
-ah 192.168.1.10	Agent callback host
-ap 4444	Agent callback port
-am	Generate the agent's mTLS certificate

Multiple Agents (Batch)

java -jar target/raven.jar \
  -m -c 10 -u team -ah 192.168.1.10 -ap 4444 -am

Flag	Meaning
-m	Multi-agent generation mode
-c 10	Number of agents/certificates to generate
-u team	Naming prefix/group for the generated batch
-ah / -ap	Shared callback host/port for the batch
-am	Generate mTLS certs for each agent in the batch

Step 3 — Enforce mTLS on the Server

Start the server with mTLS enabled so it only accepts agents presenting a valid certificate:

java -jar target/raven.jar -T

Listing Generated Agents

To review which agent certificates already exist:

java -jar target/raven.jar -l

Certificate Lifecycle Summary

        ┌────────────┐
        │   Root CA  │  (--init-certs)
        └─────┬──────┘
              │ signs
        ┌─────┴──────┐
        │   Server   │  (--init-certs)
        │ Certificate│
        └─────┬──────┘
              │ signs
        ┌─────┴──────┐
        │   Agent    │  (-a / -m ... -am)
        │ Certificate│
        └────────────┘

Best Practices

• Re-generate the CA for each new engagement; never reuse keystores across clients/projects.
• Store the CA private key offline or encrypted when not actively issuing certificates.
• Revoke/destroy agent certificates and keystores at the end of an engagement.

See Also

• Security Features
• Command Line Arguments