topic Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA certific in General Topics

Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA certific

Mike_Jensen — Wed, 29 May 2024 19:01:28 GMT

I am running R81.10 with GA Jumbo take 139 installed.

I have a custom IoC feed set to use the Talos blacklist and noticed in my logs the list is failing to update -

"External IOC - External Indicators processing failed
Talos_blacklist: Failed to fetch feed. Resource: https://www.talosintelligence.com/documents/ip-blacklist, Reason: Peer certificate cannot be authenticated with given CA certificates"

I have followed sk169919 and added the websites certificate as well as it's root certificate in the "Trusted CAs" portion of SmartDashboard's HTTPS Inspection, saved my changes, installed access control policy, and the IoC feed still fails to update for the same reason.

I am adding the certificates by going to Actions > "Import outbound Certificate".

I don't know what I am missing to make this work?

Re: Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA cert

the_rock — Wed, 29 May 2024 19:07:03 GMT

Did you choose the right format?

Andy

Re: Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA cert

PhoneBoy — Wed, 29 May 2024 20:06:59 GMT

Do you include all the intermediate CAs that are needed to validate the cert?
You might also try the workaround in: https://support.checkpoint.com/results/sk/sk169919

Re: Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA cert

Mike_Jensen — Wed, 29 May 2024 20:14:42 GMT

I ended up manually updating the trusted CA's list by downloading the .zip from the link in sk64521, then I followed the rest of that sk to install on my SMS, installed access control policy, and the IoC feed update is now successful.

Re: Gateways fail to download IoC feed - peer certificate cannot be authenticated with given CA cert

Mike_Jensen — Wed, 29 May 2024 20:16:25 GMT

I must have been missing the intermediate CA's. Fortunately the latest Check Point updated CA list has all of the certs I needed.