topic Re: Server certificate for host is not allowed in Cortex XDR Discussions

Server certificate for host is not allowed

WilliamFoisseau — Thu, 01 Oct 2020 12:30:33 GMT

hi,

I have this message on more windows server 2019(vmware environnement), after install cortex 7.1:

Server certificate for host is not allowed: error=19, message=self signed certificate in certificate chain

HTTP request failed due to an SSL error (0): SSL Exception: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed.

{trapsd:Communication:Heartbeat(scheduled):} Connectivity Error, error_type = 2
{trapsd:Communication:Heartbeat(scheduled):} Connectivity Error, error_type = 4
{trapsd:AgentIdentification:Heartbeat(scheduled):} Error retrieving provisioning url. Error code: 4. Error data:
{trapsd:AgentIdentification:Heartbeat(scheduled):} Error getting home server address with error code 4
{trapsd:AgentIdentification:Heartbeat(scheduled):} Error registering to server with error code 4
{trapsd:Communication:Heartbeat(scheduled):} Unable to obtain authentication ID, aborting request.

The endpoint not register to cloud console and stay in red. This machine have all access to internet.

Thank for your help

Re: Server certificate for host is not allowed

dfalcon — Tue, 06 Oct 2020 01:16:34 GMT

Hi @WilliamFoisseau-

Have these machines ever been able to communicate with the Cortex XDR tenant? If not, have the certs in step 3 of this document been added to the certificate store on the affected server?

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr.html

Re: Server certificate for host is not allowed

WilliamFoisseau — Fri, 09 Oct 2020 07:53:42 GMT

Hi,

A just install the root certificat on all device

Re: Server certificate for host is not allowed

Dalbir.Monga99701 — Tue, 12 Oct 2021 05:22:22 GMT

Can anyone help me with the location to download the root certs required and the location to add these .crt files to? I have got the certs and added them to the ca-bundle.crt file in /etc/ssl/certs and have restarted but it does not work, unfortunately.

Re: Server certificate for host is not allowed

jasonroy — Thu, 22 Jun 2023 19:01:09 GMT

@Dalbir.Monga99701 wrote:

Can anyone help me with the location to download the root certs required and the location to add these .crt files to? I have got the certs and added them to the ca-bundle.crt file in /etc/ssl/certs and have restarted but it does not work, unfortunately.

This will be Linux distro-specific. Ubuntu will look like:

To add:
1. Copy your CA to ls /usr/local/share/ca-certificates/
2. Use command: sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt
3. Update the CA store: sudo update-ca-certificates
To remove:
1. Remove your CA: rm /usr/local/share/ca-certificates/foo.crt
2. Update the CA store: sudo update-ca-certificates --fresh