Who rated this post

Hello Everyone,

Until now, typically certificates are validated by checking the signature hierarchy; MyCert is signed by IntermediateCert which is signed by RootCert, and RootCert is listed in my computer's "certificates to trust" store. Enabling the feature, makes the agent not to use the Local Root CA certificate Store anymore and use only the pinned roots.pem certificate file, this way protecting from Man In The Middle (MITM) attacks. For this the requirement for the agent is 8.3

Below is the path for the supported OS, where you can find the certificate.

• Windows – "C:\Program Files\Palo Alto Networks\Traps\config\roots.pem”
• macOS – “/Library/Application Support/PaloAltoNetworks/Traps/config”

For example, MITM attack can be implemented, where an attacker can configure a malicious secure proxy communication that will be used by the machine, diverting and intercepting all the agent’s communication securely. The secure communication can can be achieved by using a legitimate Root certificate installed by the attacker in the machine’s Root certificate store

Not using the Local Store and only using the trusted roots.pem file, can avoid this kind of attack.

Talking about the impact, please find the below information:

The agent checks for the root certificate in the roots.pem. If the Root signer is not found in roots.pem, the agent will check in the machine’s local store as fallback 

If the agent can verify the certificate using one of the methods above, the communications succeeds.

Kindly find more information on enforcement levels:

Disabled (notify) default: 

• Agents use using the computer’s Trusted Root Certification Authority Store (aka Local Store)
• All risky notification banners will show

Disabled:

• Agents use using the computer’s Trusted Root Certification Authority Store (aka Local Store)
• All risky notification banners will show

Enabled:

• Agents starts with learning mode phase
• Verify these 2 conditions

1. For at least 20 minutes, agents did not fallback to the local store
2. At least 2 successful heartbeats in the last 20 minutes

• If succeeded, changes from learning mode to Checks 2 conditions first
• In learning mode, agent’s operational status may show “Partially Protected”
• Failure to pass the learning mode, agents stay in Partially protected until the feature is Disabled/disabled (notify)

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.