Configure Python Docker Integrations to Trust Custom Certificates - Administrator Guide - 6.9 - Cortex XSOAR - Cortex - Security Operations

Configure the custom certificates.

1. Create a certificate PEM file that includes all of the required custom certificates.

   • To examine the certificate chain used by a specific endpoint, run the following command on the server machine (requires openssl client):

     openssl s_client -servername <host_name> -host <host_name> -port 443 -showcerts < /dev/null

     For example, openssl s_client -servername api.github.com -host api.github.com -port 443 -showcerts < /dev/null

     This prints certificate information including the PEM representation of the certificates. After examining the output, if you see Verification error: unable to get issuer certificate, one or more certificates in the certificate chain is not available and you need to obtain these certificates from your IT administrator.

   • To save the certificates to a certs.pem file run the following command:

     openssl s_client -servername api.github.com -host api.github.com -port 443 -showcerts < /dev/null 2>/dev/null | sed -n '/^-----BEGIN CERT/,/^-----END CERT/p' > certs.pem

   • To verify that the certs.pem has all needed certificates as part of the certificate chain, run openssl verify -CAfile certs.pem site.pem, where site.pem contains the certificate of a specific site you want to trust. To get the cert of a site, run openssl s_client -servername <site_host> -host <site_host> -port 443 and copy the base content including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

   • After saving the certs.pem file, add its content to /var/lib/demisto/python-ssl-certs.pem, by running the following command:

     cat certs.pem >> /var/lib/demisto/python-ssl-certs.pem

2. (RedHat only) Set the required SELinux permissions.

   • By default, when SELinux is in enforcing mode, directories under /var/lib/ cannot be accessed by Docker containers. To allow container access to the /var/lib/demisto/python-ssl-certs.pem file, you need to set the correct SELinux policy type, by typing the following command:

     chcon -t svirt_sandbox_file_t /var/lib/demisto/python-ssl-certs.pem

   • (Optional) Verify that the file has the container_file_t SELinux type attached by running the following command:

     ls -d -Z /var/lib/demisto/python-ssl-certs.pem

3. (Optional) If you require the standard set of certificates trusted by browsers, you can append the CA certificates provided by your operating system. For example, on Ubuntu, these certificates are located at the following path: /etc/ssl/certs/ca-certificates.crt. Alternatively, you can download the PEM certificates file provided by the Certifi Project and add your custom certificates to the file that contains the standard set of certificates.

   This example adds the proxy-ca.pem file (custom certificate) to the cacert.pem file (standard certificates): cat proxy-ca.pem >> cacert.pem

4. Copy the certificates PEM file to the following path.

   /var/lib/demisto/python-ssl-certs.pem

   (Multi-tenant) In a multi-tenant deployment, the certificate is copied to the following path on the host machine: /var/lib/demisto/tenants/acc_TENANT/python-ssl-certs.pem

Configure the Cortex XSOAR server settings.

1. Go to Settings → About → Troubleshooting.

2. In the Server Configuration section click Add Server Configuration.

   • Key: python.docker.use_custom_certs

   • Value: true

   (Multi-tenant) In a multi-tenant deployment, the server configuration must be added to each tenant.

3. Save the server configuration.

4. Restart the Cortex XSOAR server to verify that all existing Docker images are relaunched.

(Optional) Add the certificate files to engines.

1. Configure each engine to use the /var/lib/demisto/python-ssl-certs.pem file.

2. Ensure that you have the following directory on the engine host.

   /var/lib/demisto

3. Set the demisto user as the directory owner with 0700 permissions.

4. Copy the python-ssl-certs.pem file to the /var/lib/demisto directory.

5. Add the following configuration to either the engine configuration file (UI) or to the d1.conf file.

   "python.docker.use_custom_certs": true

6. Restart the engine.

Verify that the configuration was added successfully.

If you are using an SSL inspection proxy (MiTM) and want to verify that the certificates are properly set, you can run the following command, which will fetch from www.google.com using HTTPS, and print the headers of the response: !py script="import requests; print(requests.get('https://google.com').headers)".