Skip to content

[CVE] Add proxy certificate support for HTTPS connections - #5108

Closed
Mael Van den Plas (maelv-filigran) wants to merge 1 commit into
masterfrom
opencti/issue/12177
Closed

Mael Van den Plas (maelv-filigran) wants to merge 1 commit into
masterfrom
opencti/issue/12177

Conversation

@maelv-filigran

Copy link
Copy Markdown

Proposed changes

  • Add custom entrypoint script to CVE connector to handle proxy certificate configuration
  • Modify Dockerfile to use entrypoint script instead of direct CMD execution
  • Process HTTPS_CA_CERTIFICATES environment variable and combine with system certificates
  • Set appropriate SSL environment variables (REQUESTS_CA_BUNDLE, SSL_CERT_FILE, CURL_CA_BUNDLE) for Python requests library

Related issues

  • OpenCTI #12177
  • HTTPS_CA_CERTIFICATES is not handled by lib request used in CVE

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key
  • I tested the code for its functionality using different use cases
  • I added/update the relevant documentation (either on github or on notion)
  • Where necessary I refactored code to improve the overall quality

Further comments

This change enables the CVE connector to work properly in environments that use HTTPS proxies with custom certificates. The entrypoint script automatically detects the presence of the HTTPS_CA_CERTIFICATES environment variable and configures the appropriate certificate bundle for the Python requests library used by the connector.

The implementation:

  1. Creates a temporary certificate bundle combining proxy certificates with system certificates
  2. Exports the necessary environment variables for SSL verification
  3. Maintains backward compatibility when no proxy certificates are provided

@maelv-filigran

Mael Van den Plas (maelv-filigran) commented Oct 29, 2025 •

Copy link
Copy Markdown
Author

As seen with Helene Nguyen (@helene-nguyen) the fix is moved to client-python

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

filigran team Item from the Filigran team.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant