QRadar: Log source integration fails with certificate pinning error due to incomplete chain of trust certificate

1. SSH to QRadar as the root user.
2. Optional: If you are using as the Target Event Collector a different host than the console, SSH to that host.
3. Run the following command to obtain server certificate. This command pulls the server cert, it gives it a name with the format endpoint_port.crt. and place it in /opt/qradar/conf/trusted_certificates:

   /opt/qradar/bin/getcert.sh <Source Endpoint>

   Command example:

   /opt/qradar/bin/getcert.sh sqs.us-west-2.amazonaws.com

   Example of the command output:
   
4. Run the following command to verify that the new certificate is placed into /opt/qradar/conf/trusted_certificates: 
   ls -la /opt/qradar/conf/trusted_certificates
5. Reload the certificates, run the following command to restart ecs-ec-ingress service, the restart reloads the certificates:
   Note: For more information about the impact of restarting the ecs-ec-ingress process, check the following link​​​ : QRadar: Core services and the impact of restarting services.

   systemctl restart ecs-ec-ingress

   
   Result:
   The certificate is pulled and placed in /opt/qradar/conf/trusted_certificates.

This process uses the openssl command to get full certificate chain.

1. SSH to QRadar as the root user.
2. Optional: If you are using as the Target Event Collector a different host than the console, SSH to that host.
3. Run the following command to go to the trusted_certificate directory

   cd /opt/qradar/conf/trusted_certificates/

4. Create a file named script.txt.
5. Copy the following text into the file named script.txt. Replace <ServerFQDN> with the fully qualified domain name and <PORT> with the port number. The full command goes from 'openssl' until 'done':

   openssl s_client -showcerts -verify 5 -connect <serverFQDN>:<PORT> < /dev/null |
       awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/{ if(/BEGIN CERTIFICATE/){a++}; out="cert"a".pem"; print >out}'
   ## Command two
   for cert in *.pem; do  
           newname=$(openssl x509 -noout -subject -in $cert | sed -nE 's/.*CN ?= ?(.*)/\1/; s/[ ,.*]/_/g; s/__/_/g; s/_-_/-/; s/^_//g;p' | tr '[:upper:]' '[:lower:]').pem
            echo "${newname}"; mv "${cert}" "${newname}"  
   done

6. Run the following command to provide execute permissions to the script.txt file:

   chmod a+x script.txt

7. Execute the script with the following command:

   ./script.txt

8. List the files on trusted_certificates directory and confirm the new pulled certificates were successfully created: 
   ls -la /opt/qradar/conf/trusted_certificates/
   
   All the certs are saved with a .pem extension, for example:
   
9. If the certs are in place, restart ecs-ec-ingress service on the target event collector to reload certificates into configuration:
   Note: For more information about the impact of restarting the ecs-ec-ingress process, check the following link​​​ : QRadar: Core services and the impact of restarting services.

   systemctl restart ecs-ec-ingress

   
   Result:
   The full chain of certificates are pulled and placed on the /opt/qradar/conf/trusted_certificate path.