new feature in the Cortex XDR agent 8.3, Agent Certificates

[sebasnova]

hi

i have cortex xdr on several endpoints, can you explain me more about the new feature Agent Certificates and its implication and how to work? i want to set enabled this function because is disabled for old tenants

[abdrahman]

Dear @sebasnova , 

Hope you are doing well and thank you for reaching out to the live community. From the above query I understand that you have a query around our new changes to the Agent Certificates. 

Please note to improve security, the Cortex XDR agent 8.3 is now ensuring the use of a provided certificate without using the local fallback store (trusted root CA file). In order to graduate the adoption of this requirement, Disabled (Notify) is default for existing tenants; new tenants will have the Enabled configuration by default.

This means that for the new tenants Palo alto networks will be providing the certificate and we will not be relying on the fallback store anymore. For tenants who has not enabled this will be notified by the banner when they login to the portal. More information can be found in the link provided below, thank you: 

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.3/Cortex-XDR-Agent-Release-Notes/Changes-to-...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[sebasnova]

Hi,thanks, but

one cuestion more, What was the local certificate used for?

[Lakshminarayan]

Hi @abdrahman ,

Can you explain what is the use of Local certificate.

Does it uses during agent installation on Windows for authenticity or something else...?

If yes, then PA certificate going to be installed via Agent on windows machine. Please provide some more detailed information.

[aspatil]

Hello @Lakshminarayan  @sebasnova ,

Previously the agent does not validate which certificate is used to sign the traffic, as long as it is validly signed. Hence Validating the signer, using Root CA Local certificate store makes the agent vulnerable to Man In The Middle attacks.

This feature is created as a security effort to mitigate Man In The Middle attacks.By enabling the feature, customers can decide not to use the Local Root CA certificate Store anymore and use only the pinned roots.pem certificate file, this way protecting from Man In The Middle (MITM) attacks.

In case due to any reason, agent is not able to use roots.pem, it will fall back to local CA and will make the agents Partially protected.

If this post answers your question, please mark it as the solution. 

[Lakshminarayan]

Hi Ashutosh,

Thanks for the detailed explanation. In short if my understanding is correct then agent will push roots.pem certificate to windows machine which will be used to validate the traffic.  

[aspatil]

Hello @Lakshminarayan ,

You can find certificate in the below location:

Windows – "C:\Program Files\Palo Alto Networks\Traps\config\roots.pem”

macOS – “/Library/Application Support/PaloAltoNetworks/Traps/config”

If this post answers your question, please mark it as the solution.