📙 You will learn

How to add custom root certificates to an AppSec Container.

Prerequisites

Audience: IT Professional
Difficulty: Intermediate
Time needed: Approximately 10 minutes
Tools required: kubectl, Helm

If ThreadFix is set up to connect to an external integration via HTTPS, users may need to import the server's certificate into the ThreadFix server's Java Keystore, even if not running Tomcat over HTTPS. Otherwise the following error may be received:

...SunCertPathBuilderException: unable to find valid certification path to requested target

The following is an example when connecting to AppScan Enterprise:

Obtain Certificate

There are multiple ways to obtain the certificate, the following covers using Chrome, OpenSSL, and Root Certificate Authorities:

Using Chrome

1. Navigate to the site via the Chrome browser.
   

2. Right-click within the page and select "Inspect".
   

3. Navigate to the Security tab and click the View certificate button.
   

4. From the Details tab click the Copy to File button. Note: Mac users may not see a Copy to File button and instead should drag-and-drop the certificate to a desired directory.
   

5. Select Base64 and save the .cer file to the desired directory.

More information can be found in the Exporting Certificate Authorities (CAs) from a Website guide.

Using OpenSSL

Use the following command on a headless server:

openssl s_client -connect ${HOST}:${PORT} > certfile

Root Certificate Authorities (CAs)

For some root or intermediate Certificate Authorities (CAs) the steps may vary. For example, on an Active Directory Certificate Services server, the root CA may be found at http://<host-name>/certsrv/certcarc.asp, and users can download the .cer file with the text "Download CA certificate".

Root CAs allow ThreadFix to talk to all sites with certificates pointing to the root CA. If the user’s company has a root CA that all of its internal servers use, that root CA should be imported to the Java Keystore with the steps below. With this ThreadFix shouldn't have a certificate trust issue for any of the user’s servers.

Import Certificate

Enter the following commands on a command line to perform the described action.

1. Copy the root certificate to the server with kubectl access.
   

2. Add the Denim Group Helm repository if not present.

   helm repo add denimgroup https://threadfix-downloads.s3-us-west-2.amazonaws.com/helm/

3. Get the Helm release name for the ThreadFix instance.

   TF_RELEASE=$(helm ls | grep threadfix | awk '{print $1}')

4. Get the current installed version of ThreadFix.

   TF_VERSION=$(helm ls --filter "$TF_RELEASE" | grep -o 'threadfix-[Az0-9\.\-]*' | sed 's|threadfix-||g')

5. Set pod and deployment env vars for later use:

   TF_APPSEC_POD=$(kubectl get po -l app.kubernetes.io/name=appsec -o jsonpath='{ .items[].metadata.name }')

6. Set the certfile name

   CERT_FILE=<certificate>

7. Validate that the generated parameters are set.

   echo $TF_RELEASE
   echo $TF_VERSION
   echo $TF_APPSEC_POD
   echo $CERT_FILE

8. Copy the certificate to the appsec pod:

   kubectl cp $CERT_FILE $TF_APPSEC_POD:/usr/local/tomcat/temp/$CERT_FILE

9. Create a copy of the default cacerts file

   kubectl exec $TF_APPSEC_POD -- cp /usr/local/openjdk-11/lib/security/cacerts /usr/local/tomcat/temp/cacerts

10. Add the certificate to the Java truststore:

    kubectl exec $TF_APPSEC_POD -- keytool --importcert -file /usr/local/tomcat/temp/$CERT_FILE -keystore /usr/local/tomcat/temp/cacerts -storepass changeit -noprompt

11. Copy the generated cacerts file to the user machine:

    kubectl cp $TF_APPSEC_POD:/usr/local/tomcat/temp/cacerts cacerts

12. Create a configmap with the copied cacerts file:

    kubectl create configmap tf-cacerts --from-file=cacerts=./cacerts

13. Create myValues dir if not present.

    mkdir -p myValues

14. Create a file named 'root-ca.yaml':

    echo "appsec:
      extraVolumes:
        - name: cacerts
          configMap:
            defaultMode: 444
            name: tf-cacerts
      extraVolumeMounts:
        - mountPath: /usr/local/openjdk-11/lib/security/cacerts
          name: cacerts
          readOnly: true
          subPath: cacerts
    appsecimporter:
      extraVolumes:
        - name: cacerts
          configMap:
            defaultMode: 444
            name: tf-cacerts
      extraVolumeMounts:
        - mountPath: /usr/local/openjdk-11/lib/security/cacerts
          name: cacerts
          readOnly: true
          subPath: cacerts" > myValues/root-ca.yaml

15. Export current Helm values:

    helm get values $TF_RELEASE > currentValues.yaml

16. Run helm upgrade to apply the new configuration

    helm upgrade $TF_RELEASE denimgroup/threadfix --version $TF_VERSION -f currentValues.yaml -f myValues/root-ca.yaml

17. The appsec pod will automatically restart.The progress can be viewed with:

    kubectl get pods -w

Note: If the appsec and appsec-importer pods do not automatically restart, they can be manually restarted with the following:

kubectl rollout restart deploy/${TF_RELEASE}-appsec
kubectl rollout restart deploy/${TF_RELEASE}-appsec-importer