Failed Rule Sync - Proxy

[nilssachs]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

64

Storage for /

500GB

Storage for /nsm

1TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hey, I am running a distributed Environment behind an intercepting Proxy. so-rule-update fails with Error
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1020)>
In mentioned case #6364 a setting of binds is discussed as the solution. I configured the local bind mounting in docker -> containers -> so-idstools
src=/usr/share/pki/ca-trust-source/,dst=/etc/ssl/certs

The CA-certs (.pem) are stored in the source folder, but update still fails. Is there something else I need to consider?

Thanks a lot, Nils

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Just to confirm, did you set the proxy is SOC? https://docs.securityonion.net/en/2.4/proxy.html#