I'm trying to get CloudTrail logs into qradar. Log source Amazon AWS CloudTrail does not work. I am getting error "Error: Error with SSL Handshake connecting to host [s3.amazonaws.com] on port [443]: [com.ibm.jsse2.util.h: No trusted certificate found]"

I downloaded certificate from https://s3.amazonaws.com using script /opt/qradar/bin/getcert.sh , script saved certificate info /opt/qradar/conf/trusted_certificates. But nothing changed, error persist. Thank for help

I have seen this for customer who have a webproxy in between QRadar and the s3 amazonaws server. It could be because of the missing proxy cert in the trust store.

If that's the case, try following this https://www.ibm.com/docs/en/qsip/7.4?topic=au-configuring-updates-behind-proxy-server-that-uses-ssl-tls-interception

if you still doesn't work for you, then you should open up a IBM support ticket.

Hi Did this worked for you ? I am getting same issue while doing this for DUO. 

Thanks

Ashish