Imperva Cyber Community

Hi everyone


Here I come with another interesting issue :)

The details of this deployment is as follows:

1. WAF on premises.
2. Version: 13.5.0.20_0
3. Customer has a proxy that signed traffic based on policies.  Including traffic pointing to imperva sites.

Issue:

1- We see an error on the Threatradar dashboard related to not able to reach imperva servers

2- We already checked access to the sites need to make it works and access it allows: WAF documentation

3- We recorded a pcap on the MX and we discover that the issue is because of lack of trust on the CA certificate with the proxy signed imperva's cert.



My question

How can I upload that CA certificate in order to avoid this issue ? 


Best regards







#On-PremisesWAF(formerlySecuresphere)

------------------------------
Freddy Brito
Deploy, Support & Pre sales
DAITEK S.A.
Buenos Aires
------------------------------

Hi Freddy,

You can apply following steps on MX as root user:
1. cp -rp /etc/pki/java/cacerts /etc/pki/java/cacerts.bckp - To backup current java CA certificates
2. /etc/alternatives/jre/bin/keytool -import -file /tmp/rootca.der -trustcacerts -alias Proxy_RootCA -keystore /etc/alternatives/jre/lib/security/cacerts -storepass changeit
      rootca.der: proxy certificate
      Proxy_RootCA: custom alias name that you can set it whatever you want
3. impctl server restart

------------------------------
Cezmi Cal
technical support engineer
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara
------------------------------

Thanks Cezmi!!!

That worked!! :)


Best regards

------------------------------
Freddy Brito
Deploy, Support & Pre sales
DAITEK S.A.
Buenos Aires
------------------------------

Original Message:
Sent: 11-02-2022 05:04
From: Cezmi Cal
Subject: CA certificate issue

Hi Freddy,

You can apply following steps on MX as root user:
1. cp -rp /etc/pki/java/cacerts /etc/pki/java/cacerts.bckp - To backup current java CA certificates
2. /etc/alternatives/jre/bin/keytool -import -file /tmp/rootca.der -trustcacerts -alias Proxy_RootCA -keystore /etc/alternatives/jre/lib/security/cacerts -storepass changeit
      rootca.der: proxy certificate
      Proxy_RootCA: custom alias name that you can set it whatever you want
3. impctl server restart

------------------------------
Cezmi Cal
technical support engineer
Barikat Internet Guvenligi Bilisim Ticaret A.S.
Ankara
------------------------------