Option to ignore SSL errors from analyzers

[geekscrapy]

Some internally hosted workers for analyzers (e.g. Cuckoo) may not have a valid certificate. Can an option be created to disable SSL verification on certain analyzers?

[nadouani]

This could be made on the analyzers, one by one but needs development.

Please list the analyzers you want see with support of an option to disable SSL verification

[geekscrapy]

Fair enough - I guess the self-hosted workers would be a priority. But CuckooSandbox & MISP would be a priority for us.

But essentially all may need this if Cortex has to go through a corporate proxy?

[3c7]

I think you can add the CA or issuer cert to /etc/ssl/certs, that should work, too.

[saadkadhi]

@geekscrapy Is the solution provided by @3c7 satisfactory? Can we go ahead and close this issue?

[geekscrapy]

I haven't tried but I presume it wouldn't work for Dockerised analyzers and would require modification of the cortex docker file (appreciate this isn't hard to do)?

I think it would be best to have a dedicated SSL setting contained in the general analyzer settings?

[jeromeleonard]

this shoud be fixed in develop branch, please test it and get back to us. I added a verifyssl option in Cuckoo analyzers. Version has been bumped to 1.2