Skip to main content

Custom CA/Deep inspection firewalls

In certain cases the Edge Enforcer must connect to a Control Tower and the connection cannot be verified using standard CAs, e.g.

  • On premises Control Tower with company CA certificate
  • Deep inspection firewalls intercepting traffic.

This how-to assumes you have access to the CA certificate chain and explains how to configure the Edge Enforcer, including the host.

Host​

The Edge Enforcer installer uses curl and docker/podman under the hood. These programs use the CA certificates bundled with the OS to verify the CT endpoint.

Each Linux distribution is a bit different so you will have to check how you add a system wide CA to your particular distro.

You can test this works:

curl https://https://api.<env>.<org>.avassa.net/healthz

Which should output:

{
  "name": "api",
  "oper-status": "running"
}

Edge Enforcer on host​

Edit /etc/supd/supd.conf and add the highlighted section with your CA.

host-id: "xxx"
initial-site-config:
  call-home-servers:
    - api....
  parent-ca-cert: | 
       -----BEGIN CERTIFICATE-----
       ...
       -----END CERTIFICATE-----

Site configuration​

Finally in the site configuration, add the highlighted section.

name: test-site
type: edge
topology:
  parent-site: control-tower
parent-cluster-address:
  ca-cert: |
    -----BEGIN CERTIFICATE-----
    ...
    -----END CERTIFICATE-----
hosts:
  - host-id: xxx