Policies without certificate enforcement enabled warning message

[Aneesh]

Hi Team,

Recently I got a warning message in cortex saying that "Some of your endpoints have policies without Certificate Enforcement enabled". And by checking it further I could see that, this is to increase protection on the agent's communication by enforcing the use of root CA provided by Cortex (rather than on the local machine). 

It was in disabled state since I started using it and why it gives warning message now?

Can I get more clarity on this and what will be the impact if I enable this feature.

I am using Cortex XDR Version 3.9

Thanks in advance.

Cortex XDR 

[aspatil]

Hello @Aneesh ,

Thanks for reaching out on LiveCommunity!

The banner showing Some of your endpoints have policies without Certificate Enforcement enabled is by design. Notify(Disabled) will be the default setting. The main motivation is to push customers to enable (or disable) the feature and move from Notify to one of the other modes.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[Aneesh]

Hi @aspatil,

Thanks for the speedy response.

I understand this but my query was,

It was in disabled state since I started using it and why it gives warning message now?

Can I get more clarity on this and what will be the impact if I enable this feature.

[Rindsland]

It gives also a Risk warning for Default Policy, which I cannot edit (or I don't know how).

[Blake_Volk]

I am also curious what is the user impact, or the impact of enabling this feature?

[aspatil]

Hello Everyone,

Until now, typically certificates are validated by checking the signature hierarchy; MyCert is signed by IntermediateCert which is signed by RootCert, and RootCert is listed in my computer's "certificates to trust" store. Enabling the feature, makes the agent not to use the Local Root CA certificate Store anymore and use only the pinned roots.pem certificate file, this way protecting from Man In The Middle (MITM) attacks. For this the requirement for the agent is 8.3

Below is the path for the supported OS, where you can find the certificate.

• Windows – "C:\Program Files\Palo Alto Networks\Traps\config\roots.pem”
• macOS – “/Library/Application Support/PaloAltoNetworks/Traps/config”

For example, MITM attack can be implemented, where an attacker can configure a malicious secure proxy communication that will be used by the machine, diverting and intercepting all the agent’s communication securely. The secure communication can can be achieved by using a legitimate Root certificate installed by the attacker in the machine’s Root certificate store

Not using the Local Store and only using the trusted roots.pem file, can avoid this kind of attack.

Talking about the impact, please find the below information:

The agent checks for the root certificate in the roots.pem. If the Root signer is not found in roots.pem, the agent will check in the machine’s local store as fallback 

If the agent can verify the certificate using one of the methods above, the communications succeeds.

Kindly find more information on enforcement levels:

Disabled (notify) default: 

• Agents use using the computer’s Trusted Root Certification Authority Store (aka Local Store)
• All risky notification banners will show

Disabled:

• Agents use using the computer’s Trusted Root Certification Authority Store (aka Local Store)
• All risky notification banners will show

Enabled:

• Agents starts with learning mode phase
• Verify these 2 conditions

1. For at least 20 minutes, agents did not fallback to the local store
2. At least 2 successful heartbeats in the last 20 minutes

• If succeeded, changes from learning mode to Checks 2 conditions first
• In learning mode, agent’s operational status may show “Partially Protected”
• Failure to pass the learning mode, agents stay in Partially protected until the feature is Disabled/disabled (notify)

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[aspatil]

Hello @Rindsland ,

You can edit the default policy and update the Agent profile with the certificate enforcement enabled.

[micomi]

Hi @aspatil 

Thank you for this explanation. Does the certificate enforcement only affect the XDR agent communication or the whole communication of the OS?

[JGrover1]

How do you edit the Default Agent Settings profile though?

[aspatil]

Hello @micomi ,

It only affects Agent communication.

[aspatil]

@JGrover1 

It talks about the policy, you can duplicate the default agent settings profile, enable the Certificate enforcement and append to all the policies which uses default Agent setting profiles.

[Geismann]

@JGrover1 

I have the same problem that you can't adjust or delete the default profiles and the warning still appears.

[Silva]

Hello @aspatil, I hope you are doing well.

Do you know if is there a KB or a kind of documentation with such a level of detail that you said?

Unfortunately, the release notes of version 8.3 doesn't bring this level of detailing.

Thanks a lot for your explanation!

Regards

[aspatil]

Hello @Silva ,

You can find it in Changed Features section:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Release-Notes/February-2024

[aspatil]

Hello @Geismann ,

Would suggest you to reach out to SE or open a TAC case for more information