teapi

[Daniel_Kavan]

Hi all,

So, we are trying to connect to the teapi and getting an error on our self-signed certificate is not trusted.

Where do I export my manager's certificate & how can I code this (python) so it is trusted rather than ignored?

[PhoneBoy]

It's not the certificate necessarily, it's the Certificate Authority (which is presumably the ICA).
You might need to use the ICA Management Tool to get it: https://support.checkpoint.com/results/sk/sk30501 

Coding acceptance of this in Python is a separate question.

[Daniel_Kavan]

The developers would prefer to use a wildcard certificate rather than use the CA, becuase they think it will be more of a security risk and harder to manage changes.   Is there a way to use my gateway's certificate (signed), https://hostname.my.domain:18194/teapi/etc and force the api to use it instead of the ica reference to my manager?

[PhoneBoy]

It appears the teapi leverages UserCheck, which has a portal certificate you can replace.
See: https://support.checkpoint.com/results/sk/sk113599 

[Daniel_Kavan]

Isn't usercheck exclusively for browser connectivity vs a python script to 18194?

[PhoneBoy]

That makes more sense as UserCheck is used for the "user facing" parts of Threat Emulation/Extraction.
The SK I linked suggests that the relevant Internal CA is what you need to trust as that's how it is configured in SmartEndpoint.
Don't believe there is a supported way to change the API endpoint certificate.

[Daniel_Kavan]

I agree, that I need to trust the ICA.   Does that change every year now?

[PhoneBoy · Accepted solution]

At least for fresh installs of recent versions (e.g. R81.20), the CA should be valid until end of 2037.
You can verify this by viewing the internal_ca object (under Servers > Trusted CA in the Objects Explorer).