Let's Encrypted Made Easy

For "Let's Encrypt" You typically  use a acme client. A lot  devices support the acme but if you do not have a supported os, than sslforfree.com is gear'd for you.

The steps to generate a free certificate . YES  100% FREE! is very easy.

1: Generate a CSR 
2: add the  txt files that they  present for the acme challenge
3: execute a manual update 

Afterward upload you x509 certificate to the device

-----BEGIN CERTIFICATE-----

MIIFZzCCBE+gAwIBAgISAzXqLOBMEor1AKK5+ibWj8S2MA0GCSqGSIb3DQEBCwUA

MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD

ExpMZXQncyBFbmNyeXB0IEF1dGhvcml0eSBYMzAeFw0xODExMTIwMjE4MzRaFw0x

OTAyMTAwMjE4MzRaMBkxFzAVBgNVBAMTDnNvY3B1cHBldHMuY29tMIIBIjANBgkq

hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA436Ue8gDRg75msayqqv/Ld7kW3Wmzx0Z

S27VZsmuKrM40H0bcOJVg6GKJ4Yf3dZFrPCm7ZqlAQL3Zlk6Ozbcv85yG3xNwiwb

SPEp/VhObkr0G8nh6TUtSJnABhxlwWTS7S6EyNzEBuj/EXqfo5zs8IfqZZmhQUcH

0yKQlQEG69YY45Jbo1xcUB5vjeXkQR2RP6E5lfW/Xhx3HKzP/QIlrBoxASEL62lN

yeoj/Nn135V5TXh8NYNveEVy2OEXMzO0+9BymZW4Stpt+j91IzD1Z5OyQWTGO93K

YVbJDVgMTolXJlAwkStcY0MkiBm+wqiP4vxudxm5vZY4vtvDIL9o7QIDAQABo4IC

djCCAnIwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF

BQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBSYRnMth00q2JnGVaLoiLMfoi+r

ejAfBgNVHSMEGDAWgBSoSmpjBH3duubRObemRWXv86jsoTBvBggrBgEFBQcBAQRj

MGEwLgYIKwYBBQUHMAGGImh0dHA6Ly9vY3NwLmludC14My5sZXRzZW5jcnlwdC5v

cmcwLwYIKwYBBQUHMAKGI2h0dHA6Ly9jZXJ0LmludC14My5sZXRzZW5jcnlwdC5v

cmcvMC0GA1UdEQQmMCSCDnNvY3B1cHBldHMuY29tghJ3d3cuc29jcHVwcGV0cy5j

b20wTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEF

BQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEDBgorBgEEAdZ5AgQC

BIH0BIHxAO8AdQB0ftqDMa0zEJEhnM4lT0Jwwr/9XkIgCMY3NXnmEHvMVgAAAWcF

7Y+nAAAEAwBGMEQCIEfG8/KvJXPD7oRglsg2bzb5FxitlGNQsNgPv4yC4BPfAiBt

SCZFu/CR2g+dvev484rjOtdlaNCzLSG9Yfnig2FkiAB2ACk8UZZUyDlluqpQ/FgH

1Ldvv1h6KXLcpMMM9OVFR/R4AAABZwXtkHkAAAQDAEcwRQIhAPzK6lX94oL/6X1l

3MszcrjksBfLu/DA9Uqk9rTC1KElAiAcsElJsx971HeCnC349wWV+SltLeRh5gBn

cP9OFdPPnzANBgkqhkiG9w0BAQsFAAOCAQEADGVz4tgSICeiJSYjbOfpLJ0EOSmP

Rt8C9Pgm+9L4KBizpYK/m976zb2kOp4jecpD+NmoCc9XDmKTMssk5xbOBEerAfTe

+pBLaXDJXl4sxhkaH9pPNQiKFpqOf+SrX/S8iEBWewdQCRLDf2gbaEp4lbSTUmWy

mZ2ZUhOX8RaXgeHy2MdL4bl86JwD2bUyC9Lzy1pDtj2agGHPcmdI7v830bMQvIPD

reZizQ0LfhJx26ASmSoWKdey5sKfoIOBnCZjWivZvnTPT/FOI0wR68PLL+qZqyH/

xo5haHFFdMHQ1DfUdj3KNLSin8fpiBARWeCNyLcIi8x7ScfM3H6CS13T3A==

-----END CERTIFICATE-----

That's all that it takes, in less than 10-15minutes, you can have a valid and trusted certificate. Just remember the cert is good for only 90days per  "Let'S Encrypt" Policy

https://letsencrypt.org/docs/integration-guide/

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

 

bogon static list at cymu

https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt

The format of this list output can be used to  quickly rebuild prefix-lists

note:  output cutoff

You can use a script or   for loop and  add these entries into  your  network/security appliance and apply a drop  action for sources from these and any routing information that could be reached for network reachability.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

Junos API issues

In  RLS 18.3 I found a issues where the API interface would not  run. No system process or  listen on my  http/https  service ports.

 I 1st I thought it was web-management config

But the problem really was the fact that rest-api process could not  write traceoption to the directory due to it being "RO"  { read-only }

By disable of  the traceoptions the  api process { ligthttpd } could start up and now my  rest explorer runs on the SRX appliance.


Examples of a basic API enablement   and validation in  JunosSRX

I hope this helps for others running the API interface on a juniper SRX. Now with this  process running, I can resume making my  API calls to the  Juniper Device.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

 

Entrust L1K has two intermediate-certs

On the  Entrust L1K most Security engineers do not know  two L1K  exists and both are  validate subCA. Take this  FireFox   cert-store and the output of these two  intermediates  name L1K

NOTE:  I highlighted some key Identifiers  using  the colored arrows ;

These two  certificates  authorities are signed by Entrust Root CA G2 and the expiration  would always be less than the rootCA which expires  DEC-7-2030


So  keep this in mind when review entrust intermediate  CAs.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

 

The Top Level CA root for Let's Encrypt is  dictated  in this snapshot.

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

  

Monitoring the Event calendar

Here's a few links to  important  events calendar for   security  vendors

PANW  CHKP FTNT  ForcePoint

https://events.paloaltonetworks.com/ehome/event-calendar

https://www.checkpoint.com/events/

https://www.fortinet.com/corporate/about-us/events.html

https://www.forcepoint.com/events?region=946&field_event_type_tid_i18n=All

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o

        /  \

  

Fortimail API access

In this post we will explore  a simple  API login and request for the fortinet fortimail


1st we need to  enable the rest-api function;


   config system global
      set rest-api enable
  end


By using  curl we can test the  API access

       curl  -k  -c  mycookies.txt -d '{ "name":"admin, "password":"apiadminpassword" } ' -X POST  -H  "Content-Type: application/json"   -v https://10.10.1.10/api/v1/AdminLogin/


       curl  -k  -b  mycookies.txt   -v https://10.10.1.10/api/v1/SysStatusSysinfo/ 



Here's the request  from my postman collection

https://www.getpostman.com/

And the headers for Content-Type

{
"name": "FMLapi",
"request": {
"url": "https://10.10.10.10/api/v1/AdminLogin/",
"method": "POST",
"header": [
{
"key": "Content-Type",
"value": "application/json",
"description": ""
}
],
"body": {
"mode": "raw",
"raw": "{ \"name\" : \"socpuppetsfml\" , \"password\" : \"myadminpassword\" }"
},
"description": ""
},
"response": []
}
]
}

for more information, use the fortinet  FortiMail API reference

https://docs.fortinet.com/uploaded/files/3416/FortiMail%20REST%20API%20Reference.pdf


FTNT
https://en.wikipedia.org/wiki/Fortinet

NSE ( network security expert) and Route/Switching Engineer

kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^

=(  @  @ )=

         o