Server certificate for host is not allowed

[WilliamFoisseau]

hi,

I have this message on more windows server 2019(vmware environnement), after install cortex 7.1:

Server certificate for host is not allowed: error=19, message=self signed certificate in certificate chain

HTTP request failed due to an SSL error (0): SSL Exception: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed.

{trapsd:Communication:Heartbeat(scheduled):} Connectivity Error, error_type = 2
{trapsd:Communication:Heartbeat(scheduled):} Connectivity Error, error_type = 4
{trapsd:AgentIdentification:Heartbeat(scheduled):} Error retrieving provisioning url. Error code: 4. Error data:
{trapsd:AgentIdentification:Heartbeat(scheduled):} Error getting home server address with error code 4
{trapsd:AgentIdentification:Heartbeat(scheduled):} Error registering to server with error code 4
{trapsd:Communication:Heartbeat(scheduled):} Unable to obtain authentication ID, aborting request.

The endpoint not register to cloud console and stay in red. This machine have all access to internet.

Thank for your help

[dfalcon]

Hi @WilliamFoisseau-

Have these machines ever been able to communicate with the Cortex XDR tenant?  If not, have the certs in step 3 of this document been added to the certificate store on the affected server?

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr...

[WilliamFoisseau · Accepted solution]

Hi,

A just install the root certificat on all device

[Dalbir.Monga99701]

Can anyone help me with the location to download the root certs required and the location to add these .crt files to? I have got the certs and added them to the ca-bundle.crt file in /etc/ssl/certs and have restarted but it does not work, unfortunately. 

[jasonroy]

---

@Dalbir.Monga99701 wrote:

Can anyone help me with the location to download the root certs required and the location to add these .crt files to? I have got the certs and added them to the ca-bundle.crt file in /etc/ssl/certs and have restarted but it does not work, unfortunately. 

---

This will be Linux distro-specific.  Ubuntu will look like:

1. To add: 
   1. Copy your CA to ls /usr/local/share/ca-certificates/
   2. Use command: sudo cp foo.crt /usr/local/share/ca-certificates/foo.crt
   3. Update the CA store: sudo update-ca-certificates
2. To remove:
   1. Remove your CA: rm /usr/local/share/ca-certificates/foo.crt
   2. Update the CA store: sudo update-ca-certificates --fresh