Cortex XDR Agent certificate enforcement

[Vinothkumar_SBA]

Hi Team,

I have enabled the Cortex XDR agent settings for certificate enforcement. However, endpoints are showing as only partially protected, and the Operational Status Details indicate that certificate enforcement is disabled against policy (Failed to enable certificate enforcement due to local store fallback). Could you please help with this issue?

[aspatil]

Hello @Vinothkumar_SBA ,

As you have mentioned the error is "Failed to enable certificate enforcement due to local-store fallback". That means Certificate enforcement is not enabled and instead of root.pem , the agent is using Local store certificate which is not recommended. Hence, partially protected.

The solution is not disabling the policy, it is finding out why it is falling back. The reason may be that, you are decrypting the agent traffic or SSL inspection is enabled in your proxy or VPN.

Hence, please open a TAC support case to troubleshoot further.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution".

[S.Lin576639]

Dear Aspatil,

I have the same problem, does this error affect the protection ability or even the functionality of the Agent?

What adjustments would you recommend? Thank you.

[Dario_Palermo]

Hi, same problem here and yes, we're doing deep packet inspection, as many others do. Strangely, not all the endpoints are in partially protected state while they all have their traffic scanned with DPI. What toubleshooting is required in this case, as we can confirm that we have DPI in place? Would they add our private CA to the root ca pem file?