topic Re: teapi in API / CLI Discussion

teapi

Daniel_Kavan — Tue, 19 Nov 2024 20:53:52 GMT

Hi all,

So, we are trying to connect to the teapi and getting an error on our self-signed certificate is not trusted.

Where do I export my manager's certificate & how can I code this (python) so it is trusted rather than ignored?

Re: teapi

PhoneBoy — Wed, 20 Nov 2024 15:17:26 GMT

It's not the certificate necessarily, it's the Certificate Authority (which is presumably the ICA).
You might need to use the ICA Management Tool to get it: https://support.checkpoint.com/results/sk/sk30501

Coding acceptance of this in Python is a separate question.

Re: teapi

Daniel_Kavan — Wed, 20 Nov 2024 19:07:24 GMT

The developers would prefer to use a wildcard certificate rather than use the CA, becuase they think it will be more of a security risk and harder to manage changes. Is there a way to use my gateway's certificate (signed), https://hostname.my.domain:18194/teapi/etc and force the api to use it instead of the ica reference to my manager?

Re: teapi

PhoneBoy — Thu, 21 Nov 2024 00:03:36 GMT

It appears the teapi leverages UserCheck, which has a portal certificate you can replace.
See: https://support.checkpoint.com/results/sk/sk113599

Re: teapi

Daniel_Kavan — Thu, 21 Nov 2024 14:05:34 GMT

Isn't usercheck exclusively for browser connectivity vs a python script to 18194?

Re: teapi

PhoneBoy — Thu, 21 Nov 2024 16:46:42 GMT

That makes more sense as UserCheck is used for the "user facing" parts of Threat Emulation/Extraction.
The SK I linked suggests that the relevant Internal CA is what you need to trust as that's how it is configured in SmartEndpoint.
Don't believe there is a supported way to change the API endpoint certificate.

Re: teapi

Daniel_Kavan — Thu, 21 Nov 2024 16:48:25 GMT

I agree, that I need to trust the ICA. Does that change every year now?

Re: teapi

PhoneBoy — Thu, 21 Nov 2024 17:05:35 GMT

At least for fresh installs of recent versions (e.g. R81.20), the CA should be valid until end of 2037.
You can verify this by viewing the internal_ca object (under Servers > Trusted CA in the Objects Explorer).