{"templateId":"markdown","versions":[{"version":"v1.37","label":"v1.37 STS","link":"/products/custody/deployment/install/cold-bridge-deployment","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.36","label":"v1.36 STS","link":"/products/custody/v1.36/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/install/cold-bridge-deployment","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/install/cold-bridge-deployment","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Deploy a cold bridge","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"deploy-a-cold-bridge","__idx":0},"children":["Deploy a cold bridge"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this page when deploying cold vault operations. Only cold storage deployments require the cold bridge."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-the-cold-bridge-does","__idx":1},"children":["What the cold bridge does"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The cold bridge runs on the air-gapped cold vault server and provides:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A local UI for cold vault operations."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A local API for uploading, decoding, and downloading operation payloads."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Optional payload encryption and decryption for ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," files."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A local endpoint that the vault component polls for signing work."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For server requirements, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/deployment/planning/cold-vault-workstation"},"children":["Cold vault server planning"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"database-and-persistence-requirements","__idx":2},"children":["Database and persistence requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The cold bridge is stateless and uses in-memory storage for workloads. It does not require a database or persistent volume."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Earlier releases required a persistent volume for the cold bridge. Current releases do not."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"deployment-flow","__idx":3},"children":["Deployment flow"]},{"$$mdtype":"Tag","name":"Diagram","attributes":{"data-language":"mermaid","diagramType":"mermaid","diagramSource":"flowchart TD\n Plan[\"Plan air-gapped cold vault server\"]\n Install[\"Install cold bridge and vault stack\"]\n Configure[\"Configure cold bridge and vault\"]\n Register[\"Register cold vault\"]\n Handshake[\"Complete first-time handshake\"]\n Test[\"Test export, sign, import\"]\n\n Plan --> Install --> Configure --> Register --> Handshake --> Test\n","diagramHtml":"

Plan air-gapped cold vault server

Install cold bridge and vault stack

Configure cold bridge and vault

Register cold vault

Complete first-time handshake

Test export, sign, import

","diagramHtmlDark":"

Plan air-gapped cold vault server

Install cold bridge and vault stack

Configure cold bridge and vault

Register cold vault

Complete first-time handshake

Test export, sign, import

"},"children":["flowchart TD\n Plan[\"Plan air-gapped cold vault server\"]\n Install[\"Install cold bridge and vault stack\"]\n Configure[\"Configure cold bridge and vault\"]\n Register[\"Register cold vault\"]\n Handshake[\"Complete first-time handshake\"]\n Test[\"Test export, sign, import\"]\n\n Plan --> Install --> Configure --> Register --> Handshake --> Test\n"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-prepare-the-air-gapped-cold-vault-server","__idx":4},"children":["Step 1: Prepare the air-gapped cold vault server"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before installing the cold bridge:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Build the server according to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/deployment/planning/cold-vault-workstation"},"children":["Cold vault server planning"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that network connectivity is disabled."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Install the hardened operating system from verified media."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Install KMS or HSM drivers, if applicable."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Prepare approved transfer media for moving ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," files."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-install-cold-bridge-and-vault-components","__idx":5},"children":["Step 2: Install cold bridge and vault components"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Transfer the cold bridge, vault-release, and KMS container images, together with their configuration files, to the air-gapped cold vault server using approved physical media."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Install the components using the deployment method agreed for your environment. Deploy the cold bridge and vault together so the vault can poll the local cold bridge endpoint for signing work."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-configure-payload-encryption","__idx":6},"children":["Step 3: Configure payload encryption"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Cold bridge payload encryption is enabled by default and uses AES-256. The same passphrase must be configured on:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The cold bridge."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The core-extensions service in the online deployment, which processes cold bridge payloads."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the passphrase differs between the air-gapped cold vault server and the online system, neither side can decrypt the other's operation payloads. Contact your Customer Partner Engineer (CPE) for the specifics of configuring or changing the passphrase."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-verify-the-cold-bridge","__idx":7},"children":["Step 4: Verify the cold bridge"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After startup, call the status endpoint from the air-gapped cold vault server:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sh","header":{"controls":{"copy":{}}},"source":"curl -X GET \"{ColdBridgeURL}/v1/feed/status\"\n","lang":"sh"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Expected response shape:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n \"accountToSign\": 0,\n \"accountSigned\": 0,\n \"transactionToSign\": 0,\n \"transactionSigned\": 0,\n \"manifestToSign\": 0,\n \"manifestSigned\": 0\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5-register-the-cold-vault","__idx":8},"children":["Step 5: Register the cold vault"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["On the cold vault server, check the vault-release container logs for the vault UUID and public key."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Register the cold vault with the standard vault registration process, using the UUID and public key from the logs:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/ui/environment/vault/register"},"children":["Register a vault in the UI"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/api/environment/vault/register"},"children":["Register a vault with the API"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After registration, the vault can appear as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Pending"]}," because the cold vault cannot automatically connect to the online deployment."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-6-complete-the-vault-handshake","__idx":9},"children":["Step 6: Complete the vault handshake"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Complete the manual handshake by transferring the initial vault payload from the cold bridge to the online system:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["On the cold vault server, download the payload from the cold bridge."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file to the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Import the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file into ","Ripple Custody"," by calling ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/api/reference/openapi/vaults/paths/~1v1~1vaults~1operations~1signed/post"},"children":["Import signed operations"]},", the same operation used to import any signed cold vault payload."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify that the vault status is ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Completed"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For exact UI and API steps, see:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/ui/environment/vault/cold#complete-the-first-time-vault-handshake"},"children":["Complete the first-time vault handshake in the UI"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/api/environment/vault/cold#complete-the-first-time-vault-handshake"},"children":["Complete the first-time vault handshake with the API"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-7-test-cold-vault-operations","__idx":10},"children":["Step 7: Test cold vault operations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before using the cold vault for production operations:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create a test account using the cold vault."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Export pending operations from the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file to the cold vault server."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Upload the file to the cold bridge."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm that the operation appears in the signing queue."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Download the signed ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".dat"]}," file."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Transfer the signed file back to the online environment."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Import the signed operations and verify the result."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"cold-bridge-api-reference","__idx":11},"children":["Cold bridge API reference"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Endpoint"},"children":["Endpoint"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Method"},"children":["Method"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/status"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Get signing status counters."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/upload"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Upload operations to be signed."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/download"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GET"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Download signed operations or handshake payloads."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/v1/feed/decode"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POST"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Decode a payload for inspection before signing."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For day-to-day operation steps, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.34/api/environment/vault/cold"},"children":["Process cold vault operations with the API"]},"."]}]},"headings":[{"value":"Deploy a cold bridge","id":"deploy-a-cold-bridge","depth":1},{"value":"What the cold bridge does","id":"what-the-cold-bridge-does","depth":2},{"value":"Database and persistence requirements","id":"database-and-persistence-requirements","depth":2},{"value":"Deployment flow","id":"deployment-flow","depth":2},{"value":"Step 1: Prepare the air-gapped cold vault server","id":"step-1-prepare-the-air-gapped-cold-vault-server","depth":2},{"value":"Step 2: Install cold bridge and vault components","id":"step-2-install-cold-bridge-and-vault-components","depth":2},{"value":"Step 3: Configure payload encryption","id":"step-3-configure-payload-encryption","depth":2},{"value":"Step 4: Verify the cold bridge","id":"step-4-verify-the-cold-bridge","depth":2},{"value":"Step 5: Register the cold vault","id":"step-5-register-the-cold-vault","depth":2},{"value":"Step 6: Complete the vault handshake","id":"step-6-complete-the-vault-handshake","depth":2},{"value":"Step 7: Test cold vault operations","id":"step-7-test-cold-vault-operations","depth":2},{"value":"Cold bridge API reference","id":"cold-bridge-api-reference","depth":2}],"frontmatter":{"seo":{"title":"Deploy a cold bridge"}},"lastModified":"2026-07-22T12:13:26.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.34/deployment/install/cold-bridge-deployment","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}