mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
61 lines
2.2 KiB
Markdown
61 lines
2.2 KiB
Markdown
# API Reference: SSL/TLS Inspection Configuration
|
|
|
|
## Inspection Validation Commands
|
|
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `openssl s_client -connect host:443 -servername host` | Check certificate issuer |
|
|
| `curl -v https://host 2>&1 \| grep issuer` | Verify inspection via curl |
|
|
| `show system setting ssl-decrypt memory` | PAN-OS decryption stats |
|
|
| `show counter global filter category ssl` | PAN-OS SSL counters |
|
|
|
|
## CA Deployment Commands
|
|
|
|
### Windows (GPO/PowerShell)
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `Import-Certificate -FilePath ca.crt -CertStoreLocation Cert:\LocalMachine\Root` | Install CA cert |
|
|
| `Get-ChildItem Cert:\LocalMachine\Root \| Where Subject -like "*CA*"` | Verify deployment |
|
|
|
|
### Linux
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `cp ca.crt /usr/local/share/ca-certificates/ && update-ca-certificates` | Ubuntu/Debian |
|
|
| `cp ca.crt /etc/pki/ca-trust/source/anchors/ && update-ca-trust` | RHEL/CentOS |
|
|
|
|
### macOS
|
|
| Command | Description |
|
|
|---------|-------------|
|
|
| `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.crt` | Install CA |
|
|
|
|
## Palo Alto SSL Decryption Policy
|
|
|
|
| Setting | Description |
|
|
|---------|-------------|
|
|
| `ssl-forward-proxy` | Outbound HTTPS inspection |
|
|
| `ssl-inbound-inspection` | Inbound to internal servers |
|
|
| `block-expired-certificate yes` | Block expired server certs |
|
|
| `min-version tls1-2` | Enforce TLS 1.2 minimum |
|
|
|
|
## Exemption Categories
|
|
|
|
| Category | Reason |
|
|
|----------|--------|
|
|
| Certificate-pinned apps | Apple Update, Microsoft Update, Dropbox |
|
|
| Healthcare/Financial | HIPAA/PCI privacy requirements |
|
|
| Legal privilege | Attorney-client communication |
|
|
|
|
## Python Libraries
|
|
|
|
| Library | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| `ssl` | stdlib | TLS handshake, version testing |
|
|
| `socket` | stdlib | TCP connections |
|
|
| `subprocess` | stdlib | PowerShell CA verification |
|
|
|
|
## References
|
|
|
|
- Palo Alto SSL Decryption: https://docs.paloaltonetworks.com/network-security/decryption
|
|
- NIST SP 800-52 Rev 2: https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final
|
|
- US-CERT HTTPS Inspection: https://www.cisa.gov/news-events/alerts/2017/03/13/https-interception-weakens-tls-security
|