Any manual actions needed for new certificate enforcement?

[dgagnon]

With the announcement of certificate enforcement for Cortex XDR 8.3, I haven't seen any guidance on how to install or where to download the certificates that XDR agents will be using. The lack of information concerns me because I don't want to enable this setting and then have XDR break because the endpoints do not have the required certificate. If the XDR agent is retrieving the required certificate automatically and no additional endpoint configuration is needed, that would be good to know. But if a certificate needs to be manually installed on the endpoints, it would help to be provided with instructions on how to accomplish this.

[abdrahman · Accepted solution]

Dear @dgagnon , 

Hope you are doing well, and thank you for reaching out to our live Community. Please note To improve security, the Cortex XDR agent 8.3 is now ensuring the use of a provided certificate without using the local fallback store (trusted root CA file). In order to graduate the adoption of this requirement, Disabled (Notify) is default for existing tenants; new tenants will have the Enabled configuration by default.

All new tenants will be coming with this setting as enabled out of the box. However, for the older tenants this needs to be enabled from the policy settings. Please note, If the agent is initially unable to communicate without the local store, enforcement is not enabled and the agent will show as partially protected in the server UI. Once the communication is successful and the certificates are downloaded then the enforcement will be set to Enabled. 

Please note that all this process is going to be automatic and we do not need to manually download the Certificates, you may try to enable this settings to a pilot group of endpoints and test it yourself to make you comfortably to do the changes to the whole tenant. Thank you. 

More information can be found in the documentation provided below, thank you: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.3/Cortex-XDR-Agent-Release-Notes/Changes-to-...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[zarnous · Accepted solution]

Hi @dgagnon ,

When you enable this feature , it , makes the agent not to use the Local Root CA certificate Store anymore and use only the pinned roots.pem certificate file, this PEM file is downloaded with content updates  , which you can see it under the content folder directory - C:\ProgramData\Cyvera\LocalSystem\Download\content

As seen below

When the agent starts, restarts, or installed, the roots.pem file gets copied and loaded into the configuration and you can see it under the config directory - C:\Program Files\Palo Alto Networks\Traps\config\roots.pem
As seen below

This will give you the assurance that the agent will use the roots.pem.

One more thing i would recommend here, is to also enable the newly introduced field, field “LAST CERTIFICATE ENFORCEMENT FALLBACK” under the Endpoint --> All Endpoints to have this as a check point and see if the agent fallback to use its local store to validate certificates.

Hope that helped!

If that answered the question please feel free to mark this as a solution so other can benefit from!

Best,
Z

[MarcoMJ]

I was using cytool commands just to know a little more about this new feature and I noticed the output from the cytool cert_enforcement query command showed the next: 
 
Current config = 'Enable'
Current state = 'Delayed'
Policy Override = 'Policy'
 
Do you know what the "current state='delayed' " means? 

[zarnous]

Hi @MarcoMJ 
Delayed means that the agent is in the learning mode. After enabling the enforcement, the agent starts the learning mode for 20 minutes and if the connection is maintained with at least 2 successful heartbeats, it moves form the learning mode (shows as "Delayed") to the enforcement mode (shows as "Enabled" ) 

[MarcoMJ]

Than you! I exactly noticed that behaviour during my tests.