Skip to main content

Integrations

Set Up the Client-Side mTLS

The Check Point Management Server and the Illumio HAProxy server need to establish an mTLS connection. The following procedure describes how to configure this mTLS connection.

For more information about configuring TLS for Check Point Log Exporter, see Log Exporter TLS Configuration.

  1. Email Illumio to obtain the root cert in the .pem format, such as ca.pem.

  2. If you do not already have a private key, generate one and a certificate signing request using the following commands:

    openssl genrsa -out log_exporter.key 2048

openssl req -new -key log_exporter-key -out log_exporter.csr

  3. Send the og_exporter.csr file back to Illumio. Illumio signs the certificate file and returns the signed client certificate (log_exporter.crt) back to you. You then convert the certificate to the P12 format with the following command:

    openssl pkcs12 -inkey log_exporter.key -in log_exporter.crt -export -out log_exporter.p12

  4. Install the certificate with the appropriate permissions (in expert mode):

    1. Run cd $EXPORTERDIR/targets/<Name of Log Exporter Target>

    2. Run mkdir -v certificates to create a directory to store the certificates.

    3. Run cd certificates.

    4. Transfer the ca.pem and log_exporter.p12 certificate files to the new certificate directory.

    5. Run chmod -v +r cap.em and chmod -v +r log_exporter.p12.

    6. Edit the targetConfiguration.xml file to add the full path to the new certificates and the challenge phrase used to create the P12 certificate. Make sure that the file contains <security>tls</security>.

      <pem_ca_file>/opt/CPrt-R81.20/log_exporter/targets/LogServer/certificates/ca.pem</pem_ca_file>
<p12_certificate_file>/opt/CPrt-R81.20/log_exporter/targets/LogServer/certificates/log_exporter.p12</p12_certificate_file>
<client_certificate_challenge_phrase>$Encrypted$</client_certificate_challenge_phase>