uberAgent

Using uberAgent With Self-Signed Certificates

July 9, 2024

Contributed by:

uberAgent natively supports secure data transport for multiple backends, like Splunk, Elasticsearch, or Apache Kafka (via Confluent REST Proxy). For such communication via HTTPS uberAgent uses libcurl (a variant of curl), which is probably the highest-quality networking library available today.

Why Using Self-Signed Certificates

One might come to a point, during a PoC or evaluation phase, when using a certificate issued by an external or internal CA is not possible or a very complex process. Backends like Splunk or Elasticsearch offer the creation of self-signed certificates, which, by default, are not trusted by libcurl when presented to the client during the communication process. Therefore communication between uberAgent and the desired backend will fail. However, there are ways to change the configuration to make such a test scenario work.

Working With Self-Signed Certificates on macOS

uberAgent on macOS uses the operating systems implementation of libcurl. And libcurl itself utilizes LibreSSL as its library. This can be easily verified by typing curl --version in the Terminal. The following output is an excerpt from a system running macOS 11.1 (Big Sur).

curl 7.64.1 (x86_64-apple-darwin20.0) libcurl/7.64.1 (SecureTransport) LibreSSL/2.8.3 zlib/1.2.11 nghttp2/1.41.0
<!--NeedCopy-->

In order to establish a successful connection, the following tasks need to be accomplished:

Import the self-signed certificate into the macOS system keychain (aka Keychain.app), e.g. by double-clicking it
Set the trust level for the just imported certificate to Always Trust, by using the Keychain.app

Working With Self-Signed Certificates on Windows

uberAgent supports a variety of different versions of Microsoft Windows. Since not every operating system release comes with its own implementation of libcurl, uberAgent takes care of that.

Libcurl for Windows relies on Schannel as its library. Since Schannel acts differently, compared to LibreSSL on macOS when dealing with self-signed certificates, the following steps are required:

Import the self-signed CA certificate into the Windows certificate store (Trusted Root Certification Authorities)
Depending on your requirement, add either TLSRevocationChecksDisabled or TLSRevocationChecksBestEffort or TLSVerifyPeerDisabled or TLSVerifyHostDisabled as an additional ConfigFlag to your uberAgent configuration

An example configuration stanza looks like this:

[Miscellaneous]
DebugMode = true
ConfigFlags = TLSRevocationChecksBestEffort
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Using uberAgent With Self-Signed Certificates

July 9, 2024

Contributed by:

July 9, 2024

Contributed by:

Using uberAgent With Self-Signed Certificates

Why Using Self-Signed Certificates

Working With Self-Signed Certificates on macOS

Working With Self-Signed Certificates on Windows

In this article