topic Re: Cortex XDR Agent certificate enforcement in Cortex XDR Discussions

Cortex XDR Agent certificate enforcement

Vinothkumar_SBA — Wed, 12 Jun 2024 07:38:13 GMT

Hi Team,

I have enabled the Cortex XDR agent settings for certificate enforcement. However, endpoints are showing as only partially protected, and the Operational Status Details indicate that certificate enforcement is disabled against policy (Failed to enable certificate enforcement due to local store fallback). Could you please help with this issue?

Re: Cortex XDR Agent certificate enforcement

aspatil — Wed, 12 Jun 2024 07:41:35 GMT

Hello @Vinothkumar_SBA ,

As you have mentioned the error is "Failed to enable certificate enforcement due to local-store fallback". That means Certificate enforcement is not enabled and instead of root.pem , the agent is using Local store certificate which is not recommended. Hence, partially protected.

The solution is not disabling the policy, it is finding out why it is falling back. The reason may be that, you are decrypting the agent traffic or SSL inspection is enabled in your proxy or VPN.

Hence, please open a TAC support case to troubleshoot further.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".

Re: Cortex XDR Agent certificate enforcement

S.Lin576639 — Wed, 14 Aug 2024 03:00:17 GMT

Dear Aspatil,

I have the same problem, does this error affect the protection ability or even the functionality of the Agent?

What adjustments would you recommend? Thank you.

Re: Cortex XDR Agent certificate enforcement

Dario_Palermo — Mon, 30 Sep 2024 19:44:13 GMT

Hi, same problem here and yes, we're doing deep packet inspection, as many others do. Strangely, not all the endpoints are in partially protected state while they all have their traffic scanned with DPI. What toubleshooting is required in this case, as we can confirm that we have DPI in place? Would they add our private CA to the root ca pem file?