Evalulate-STIG to STIG Manager

[jace5869]

I had this working on a previous install, but sense moving the containers to a new server I can not get Evaluate STIG to publish to STIG Manager.

All I am seeing is this:
Uploading to STIG Manager... Processing 355 Vulnerabilities... ERROR: Unable to create Access Request Token. ERROR: Unable to obtain stig, aborting... Done!

I've generated the PKCS11 keys a couple of times and extracted the cert and key fro mthe .pem file using portable git and the -legacy switch.

I made sure the full path to the cert and key are in the Preferences file.
The collection ID is correct.
The collection name is correct.

API address is https://stigman.fqdn.com:54000/api
Authority address is https://stigman.fqdn.com/kc/realms/stigman

Maybe these addresses are supposed to be http instead?
I do see when I try to go to the /api address I get a ERR_SSL_PROTOCOL_ERROR
Not sure what I am supposed to be seeing on that page, to be honest

[cd-rite]

Hi @jace5869
It sounds like the CA for the cert you are using for SSL (probably in your proxy in front of stigman/keycloak etc?) might not be trusted on the machine you are running Eval STIG or the browser on. This would be distinct from the cert/key that Eval-STIG uses to authenticate.

[jace5869]

Thank you for the response.
I will import some certs to the trusted store and give it another go.

[jace5869]

So I'll added the server cert and intermediate cert to the trust store. The box I'm running it from, I've tried two different ones, still won't work.

Is there some magic to get this work behind the mTLS? That seems to be the issue.

Even trying to get stigman-watcher to work with client id and password presents the same or similar issue.

Basically with both I am seeing:

"unable to verify the first certificate","UNABLE TO VERIFY LEAF SIGNATURE"

The DoD cert bundle is imported into the java keystore for keycloak the dod chain cert is used on the nginx side.

[jace5869]

Okay, I've gotten the stigman-watcher service account to log in. I can see that in keycloak and stigman.
When I run the command on linu (no success on windows yet, it just sits at
{"timestamp": "","level","info","compenent":"scan" I get a started and ended

I'm wonder if there is something wrong with the path, it is UNC.

it shows up as "//path/to/ckl/files/"

[codwow]

Are you using stigman-watcher or client with a cert to upload the results to stig manager?

[CantaloupeFrosty1832]

Hello!

I'm having the same issues stated above trying to use client with a cert to upload results to stig manager?

Running on RHEL 9.

Uploading to STIG Manager... Processing 177 Vulnerabilities... ERROR: Unable to create Access Request Token. ERROR: Unable to obtain collection, aborting... Done!

I've generated the PKCS11 keys a couple of times and extracted the cert and key from the .pem file using portable git and the -legacy switch.

I made sure the full path to the cert and key are in the Preferences file.

The collection ID is correct.
The collection name is correct.

I think it may be an issue with the different algorithms being used by eval-stig / keycloak, but I am not sure how figure that out.

I tried to follow the instruction here https://github.com/randoms7ring/stig-manager-with-evaluate-stig/ to extract the keys outside of rhel 9 with no luck.

Has anyone had this issue or can direct me to some documentation?