📙 You will learn

How to add custom root certificates to an AppSec Container.

Prerequisites

Audience: IT Professional
Difficulty: Intermediate
Time needed: Approximately 10 minutes
Tools required: kubectl, Helm

If ThreadFix is set up to connect to an external integration via HTTPS, users may need to import the server's certificate into the ThreadFix server's Java Keystore, even if not running Tomcat over HTTPS. Otherwise the following error may be received:

...SunCertPathBuilderException: unable to find valid certification path to requested target

The following is an example when connecting to AppScan Enterprise:

Obtain Certificate

There are multiple ways to obtain the certificate, the following covers using Chrome, OpenSSL, and Root Certificate Authorities:

Using Chrome

1. Navigate to the site via the Chrome browser.
   

2. Right-click within the page and select "Inspect".
   

3. Navigate to the Security tab and click the View certificate button.
   

4. From the Details tab click the Copy to File button. Note: Mac users may not see a Copy to File button and instead should drag-and-drop the certificate to a desired directory.
   

5. Select Base64 and save the .cer file to the desired directory.

More information can be found in the Exporting Certificate Authorities (CAs) from a Website guide.

Using OpenSSL

Use the following command on a headless server:

openssl s_client -connect ${HOST}:${PORT} > certfile

Root Certificate Authorities (CAs)

For some root or intermediate Certificate Authorities (CAs) the steps may vary. For example, on an Active Directory Certificate Services server, the root CA may be found at http://<host-name>/certsrv/certcarc.asp, and users can download the .cer file with the text "Download CA certificate".

Root CAs allow ThreadFix to talk to all sites with certificates pointing to the root CA. If the user’s company has a root CA that all of its internal servers use, that root CA should be imported to the Java Keystore with the steps below. With this ThreadFix shouldn't have a certificate trust issue for any of the user’s servers.

Import Certificate

Enter the following commands on a command line to perform the described action.

1. Copy the root certificate to the server with kubectl access.
   

2. Add the Denim Group Helm repository if not present.

   Code Block
   helm repo add denimgroup https://threadfix-downloads.s3-us-west-2.amazonaws.com/helm/

3. Get the Helm release name for the ThreadFix instance.

   Code Block
   TF_RELEASE=$(helm ls | grep threadfix | awk '{print $1}')

4. Get the current installed version of ThreadFix.

   Code Block
   TF_VERSION=$(helm ls --filter "$TF_RELEASE" | grep -o 'threadfix-[Az0-9\.\-]*' | sed 's|threadfix-||g')

5. Set pod and deployment env vars for later use:

   Code Block
   TF_APPSEC_POD=$(kubectl get po -l app.kubernetes.io/name=appsec -o jsonpath='{ .items[].metadata.name }')

6. Set the certfile name

   Code Block
   CERT_FILE=<certificate>

7. Validate that the generated parameters are set.

   Code Block
   echo $TF_RELEASE echo $TF_VERSION echo $TF_APPSEC_POD echo $CERT_FILE

8. Copy the certificate to the appsec pod:

   Code Block
   kubectl cp $CERT_FILE $TF_APPSEC_POD:/usr/local/tomcat/temp/$CERT_FILE

9. Create a copy of the default cacerts file

   Code Block
   kubectl exec $TF_APPSEC_POD -- cp /usr/local/openjdk-11/lib/security/cacerts /usr/local/tomcat/temp/cacerts

10. Add the certificate to the Java truststore:

    Code Block
    kubectl exec $TF_APPSEC_POD -- keytool --importcert -file /usr/local/tomcat/temp/$CERT_FILE -keystore /usr/local/tomcat/temp/cacerts -storepass changeit -noprompt

11. Copy the generated cacerts file to the user machine:

    Code Block
    kubectl cp $TF_APPSEC_POD:/usr/local/tomcat/temp/cacerts cacerts

12. Create a configmap with the copied cacerts file:

    Code Block
    kubectl create configmap tf-cacerts --from-file=cacerts=./cacerts

13. Create myValues dir if not present.

    Code Block
    mkdir -p myValues

14. Create a file named 'root-ca.yaml':

    Code Block

    echo "appsec: extraVolumes: - name: cacerts configMap: defaultMode: 444 name: tf-cacerts extraVolumeMounts: - mountPath: /usr/local/openjdk-11/lib/security/cacerts name: cacerts readOnly: true subPath: cacerts appsecimporter: extraVolumes: - name: cacerts configMap: defaultMode: 444 name: tf-cacerts extraVolumeMounts: - mountPath: /usr/local/openjdk-11/lib/security/cacerts name: cacerts readOnly: true subPath: cacerts" > myValues/root-ca.yaml

15. Export current Helm values:

    Code Block
    helm get values $TF_RELEASE > currentValues.yaml

16. Run helm upgrade to apply the new configuration

    Code Block
    helm upgrade $TF_RELEASE denimgroup/threadfix --version $TF_VERSION -f currentValues.yaml -f myValues/root-ca.yaml

17. The appsec pod will automatically restart.The progress can be viewed with:

    Code Block
    kubectl get pods -w

Note: If the appsec and appsec-importer appsecimporter pods do not automatically restart, they can be manually restarted with the following:

kubectl rollout restart deploy/${TF_RELEASE}-appsec
kubectl rollout restart deploy/${TF_RELEASE}-appsec-importerappsecimporter