[Q&A] In what cases certutil is called?

[m-pastuszek]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

I have a problem with some part of endpoints.
Our antivirus reports that GLPI Agent calls certutil command on these computers daily.

How can I get rid of it?

Command example:
certutil -encode 263e13feda18940d0fbb177d88e8cbc6a6a63fe7.crt temp.cer

[g-bougard]

Hi @m-pastuszek

this is used to permit people to store and deploy the GLPI server SSL certificate from the system keystore.

You should be able to get rid of this feature by setting ca-cert-dir to an existing folder.

[m-pastuszek]

Hi @g-bougard, firstly I've changed HTTPS server address back to HTTP, but problem still exists.

Also, previously my self-signed SSL certificate (trusted domain CA) was already in local Trusted CA store, which is added through GPO policy.
Do I still need to set ca-cert-dir?

[g-bougard]

You only need to set ca-cert-dir if it's a problem to use local store (as your AV seems complains about that). Maybe I miss understood your question: if you better wanted to know how to publish you private CA into the keystore so it used by GLPI-Agent, then you should know GLPI-Agent 1.4 only looks into few places. You may try GLPI-Agent nightly build as it looks in other commonly used keystore.

But if you really want to use a private CA and don't want your AV to complain: or you put GLPI-Agent in a whitelist in your AV so it won't complain anymore, or you need to use ca-cert-file or ca-cert-dir option.

[m-pastuszek]

But even if I use http communication, it's still called.

[g-bougard]

This is simply not possible. You shoudldo something wrong. If you changed the server url, did you also restart the service ? Anyway you can set debug=2 (and restart) to have more information and share more about the real context where certutil is still called.

[m-pastuszek]

Thank You for clarifying. AV was still giving false positives for computers that I've changed back to HTTP. Some of them were still with HTTPS, so if same command appeared, it showed also this "changed" computers on the list.

But so far after changing it to HTTP, it stopped I think. I can leave it as it is with HTTP, because it's only LAN communication, so it's secured.