📙 You will learn

How to add custom root certificates to an AppSec Container.

Prerequisites

Audience: IT Professional
Difficulty: Intermediate
Time needed: Approximately 10 minutes
Tools required: kubectl, Helm

If ThreadFix is set up to connect to an external integration via HTTPS, users may need to import the server's certificate into the ThreadFix server's Java Keystore, even if not running Tomcat over HTTPS. Otherwise the following error may be received:

...SunCertPathBuilderException: unable to find valid certification path to requested target

The following is an example when connecting to AppScan Enterprise:

Obtain Certificate

There are multiple ways to obtain the certificate, the following covers using Chrome, OpenSSL, and Root Certificate Authorities:

Using Chrome

Navigate to the site via the Chrome browser.
Right-click within the page and select "Inspect".
Navigate to the Security tab and click the View certificate button.
From the Details tab click the Copy to File button. Note: Mac users may not see a Copy to File button and instead should drag-and-drop the certificate to a desired directory.
Select Base64 and save the .cer file to the desired directory.

More information can be found in the Exporting Certificate Authorities (CAs) from a Website guide.

Using OpenSSL

Use the following command on a headless server:

openssl s_client -connect ${HOST}:${PORT} > certfile

Root Certificate Authorities (CAs)

For some root or intermediate Certificate Authorities (CAs) the steps may vary. For example, on an Active Directory Certificate Services server, the root CA may be found at http://<host-name>/certsrv/certcarc.asp, and users can download the .cer file with the text "Download CA certificate".

Root CAs allow ThreadFix to talk to all sites with certificates pointing to the root CA. If the user’s company has a root CA that all of its internal servers use, that root CA should be imported to the Java Keystore with the steps below. With this ThreadFix shouldn't have a certificate trust issue for any of the user’s servers.

Import Certificate

In the following instructions replace <certificate> with the name of the desired root certificate file.

Enter the following commands on a command line to perform the described action.

Copy the root certificate to the server with kubectl access.

Add the Denim Group Helm repository if not present.

helm repo add denimgroup https://threadfix-downloads.s3-us-west-2.amazonaws.com/helm/

Get the Helm release name for the ThreadFix instance.

TF_RELEASE=$(helm ls | grep threadfix | awk '{print $1}')

Get the current installed version of ThreadFix.

TF_VERSION=$(helm ls --filter "$TF_RELEASE" | grep -o 'threadfix-[Az0-9\.\-]*' | sed 's|threadfix-||g')

Set pod and deployment env vars for later use:

TF_APPSEC_POD=$(kubectl get po -l app.kubernetes.io/name=appsec -o jsonpath='{ .items[].metadata.name }')

Set the certfile name
```
CERT_FILE=<certificate>
```

Validate that the generated parameters are set.

echo $TF_RELEASE
echo $TF_VERSION
echo $TF_APPSEC_POD
echo $CERT_FILE

Copy the certificate to the appsec pod:

kubectl cp $CERT_FILE $TF_APPSEC_POD:/usr/local/tomcat/temp/$CERT_FILE

Create a copy of the default cacerts file

kubectl exec $TF_APPSEC_POD -- cp /usr/local/openjdk-11/lib/security/cacerts /usr/local/tomcat/temp/cacerts

Add the certificate to the Java truststore:

kubectl exec $TF_APPSEC_POD -- keytool --importcert -file /usr/local/tomcat/temp/$CERT_FILE -keystore /usr/local/tomcat/temp/cacerts -storepass changeit -noprompt

Copy the generated cacerts file to the user machine:

kubectl cp $TF_APPSEC_POD:/usr/local/tomcat/temp/cacerts cacerts

Create a configmap with the copied cacerts file:

kubectl create configmap tf-cacerts --from-file=cacerts=./cacerts

Create myValues dir if not present.
```
mkdir -p myValues
```

Create a file named 'root-ca.yaml':

echo "appsec:
  extraVolumes:
    - name: cacerts
      configMap:
        defaultMode: 444
        name: tf-cacerts
  extraVolumeMounts:
    - mountPath: /usr/local/openjdk-11/lib/security/cacerts
      name: cacerts
      readOnly: true
      subPath: cacerts
appsecimporter:
  extraVolumes:
    - name: cacerts
      configMap:
        defaultMode: 444
        name: tf-cacerts
  extraVolumeMounts:
    - mountPath: /usr/local/openjdk-11/lib/security/cacerts
      name: cacerts
      readOnly: true
      subPath: cacerts" > myValues/root-ca.yaml

Export current Helm values:

helm get values $TF_RELEASE > currentValues.yaml

Run helm upgrade to apply the new configuration

helm upgrade $TF_RELEASE denimgroup/threadfix --version $TF_VERSION -f currentValues.yaml -f myValues/root-ca.yaml

The appsec pod will automatically restart.The progress can be viewed with:
```
kubectl get pods -w
```

Note: If the appsec and appsecimporter pods do not automatically restart, they can be manually restarted with the following:

kubectl rollout restart deploy/${TF_RELEASE}-appsec
kubectl rollout restart deploy/${TF_RELEASE}-appsecimporter

Adding Custom Root Certificates to OAuth - WIP