topic Re: Trusted CA updates in Firewall and Security Management

Trusted CA updates

Kaspars_Zibarts — Mon, 26 Apr 2021 14:06:51 GMT

We have started evaluating "HTTPS lite" option as our legacy explicit proxy solution replacement and I stumbled across a challenge of flaky Trusted CA updates process.

I'm referring to these two SKs:

sk64521 - How to enable and install update of Trusted CA list for HTTPS Inspection and Categorization

sk132812 - How to force an update to the HTTPS Trusted Root CA list

I have couple of questions.

Q1: where I could find info about latest available Trusted CA update? When it was released and the version itself. By some reverse engineering of two SKs above I can see that our management thinks that the latest version is 2.7 released 1st Dec 2020:

I'm not entirely sure if indeed it is the latest version as bunch of trusted Microsoft CAs are missing.

Q2: how can we interpret update status codes? "3" does not sound good to me as normally "0" or "1" would be success:

Q3: could Checkpoint publish "offline" version of updateFile.zip file in an SK for manual download in case automated way does not work. I.e. - we did not get any notification that there was a new version available until I manually fetched updateFile.zip file from management and loaded it manually using SmartDashboard

Q4: Bunch of well known CAs are still missing, see MS example below where we had to add them manually:

Just wondering if it would be smart to create some sort of collaboration so we as customers could provide feedback on "missing" CA so they get incorporated into official bundles faster? I just want to avoid constant manual chasing of trusted CAs from logs when sites cannot be categorised because root CA is not known to Checkpoint

Any other thoughts and suggestions are welcome if you have found a better way! I.e. using CCADB

Re: Trusted CA updates

_Val_ — Mon, 26 Apr 2021 07:56:32 GMT

Q1 - In SmartDashboard, under HTTPSi, in advanced, you should see if a new update is available.

Q2 - AFAIK, the codes are not about mistakes. If you suspect that you did not get the lates update, please check with TAC

Q3 & Q4 - Best to take with TAC.

Re: Trusted CA updates

Kaspars_Zibarts — Mon, 26 Apr 2021 08:07:37 GMT

Q1 - that's the problem Val - SmartDashboard did not show that 🙂 Even though it was downloaded and available on the disk after digging into it with CLI. Hence my rant about "flaky-ness"

Re: Trusted CA updates

_Val_ — Mon, 26 Apr 2021 09:33:35 GMT

Then you most probably installed the lates one already. Once again, please take it with TAC

Re: Trusted CA updates

Kaspars_Zibarts — Mon, 26 Apr 2021 13:40:33 GMT

NP, will take up with our SE. Just wondered if there was a general knowledge out there about the topic 🙂

Re: Trusted CA updates

Tobias_Moritz — Tue, 27 Apr 2021 10:29:41 GMT

We have the same problem and our partner told us they never saw this working for any of their customers.

We opened a TAC case and the outcome (from T3) was:

"I have consulted with our colleagues at R&D, they have informed that they are aware of this issue and are currently working on a fix. Once it is completed it will then be integrated in the Main Jumbo."

That was mid of March. Not seen something related on Jumbo Release Notes yet, so I guess its still unfixed.

Re: Trusted CA updates

Omer_Ran — Tue, 27 Apr 2021 12:48:09 GMT

Hi,

I'm the developer that prepared the fix.

I'd like to verify that the problem you see is indeed the one I've fixed.

Can you please specify the exact version/build of SmartConsole (from SmartConsole's "About") dialog?

Re: Trusted CA updates

Kaspars_Zibarts — Tue, 27 Apr 2021 12:52:02 GMT

Here we go:

Re: Trusted CA updates

Kaspars_Zibarts — Tue, 27 Apr 2021 12:53:42 GMT

BTW, could you confirm that ver 2.7 is the latest for Trusted CAs? 🙂

Re: Trusted CA updates

schvetz — Tue, 27 Apr 2021 13:02:50 GMT

Yes, it is

Re: Trusted CA updates

Omer_Ran — Tue, 27 Apr 2021 13:03:48 GMT

I'm sorry, I'm not familiar with that aspect of the feature.

I'll try to get feature owner to answer.

Re: Trusted CA updates

Marcel_Gramalla — Tue, 27 Apr 2021 13:08:38 GMT

A few of the CAs are missing on my system as well but not all of them. The Azure CAs are missing for example. In the path I also see version 2.7 on my system.

Re: Trusted CA updates

schvetz — Tue, 27 Apr 2021 13:13:06 GMT

As far as I know the Azure certificates are not missing in 2.7, you can try to install it. Did you install it?

Re: Trusted CA updates

schvetz — Tue, 27 Apr 2021 13:24:03 GMT

Hello

Do you use portable mode or did you installed the Smart Console?

Re: Trusted CA updates

Kaspars_Zibarts — Tue, 27 Apr 2021 13:28:42 GMT

yes indeed i did install 2.7 maually.

But - couple of days after manual CA addition. So that could be reason why they still show as "user" defined

That's why it would be nice to have an SK that would list the contents of update 2.7 and any new ones 🙂

Re: Trusted CA updates

Marcel_Gramalla — Tue, 27 Apr 2021 13:32:37 GMT

How do I install the version manually? Last Update Time says: 1619516783 (today) and I don't have a pop-up in SmartDashboard. Do I have to change the value in the SK to force it?

Re: Trusted CA updates

Kaspars_Zibarts — Tue, 27 Apr 2021 13:55:21 GMT

I downloaded it from MDS/CMA to laptop:

and then used SmartDashboard to import:

Re: Trusted CA updates

schvetz — Tue, 27 Apr 2021 13:56:07 GMT

you don't need to have: Microsoft Azure TLS Issuing CA 01

you have its parent see image,

if you suspect you have missing certificate, download it, go to its properties and look if you have a parent in its chain,

Re: Trusted CA updates

schvetz — Tue, 27 Apr 2021 13:59:19 GMT

Good, you have the latest bundle, the certificate that are missing should not be there, you have its parents as shown in image.
You cannot have all the certificates in the world... so you have only the ones in the "top" to confirm all the rest.

A quick question do you use portable smart console or did you install it?

Re: Trusted CA updates

Kaspars_Zibarts — Tue, 27 Apr 2021 14:11:31 GMT

SmartConsole is installed, not portable.

If that cert was missing we were getting "Detect" logs that site could not be categorised as cert was not trusted, for example