This article explains how to fix the issue if we are getting the error 'Cannot establish secure connection to the console. Check if your QRadar Certificates are setup properly' while accessing the application.

You will find the error below error from the app.log:

HTTPSConnectionPool(host=’ qradar.example.ibm.com‘, port=443): Max retries exceeded with 
url: //api/ariel/ (Caused by   SSLError(SSLError("bad handshake: Error([('SSL routines', 
'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')],)",),))

This issue will occur when you install a custom certificate on the Console, but it doesn't add to on App host

To fix the issue, please add the certificate on the App host using the steps below:

1. Copy the Root CA and intermediate files to the directory: /etc/pki/ca-trust/source/anchors

  cp /<copy from directory> /etc/pki/ca-trust/source/anchors

1. Run the following command to update the truststore.

  #update-ca-trust

1. The applications docker container must be restarted so the application can pick up the updated certificate.

  ​systemctl restart docker  ​

1. You can verify that the updated certificates are being leveraged by connecting to the app in question. To locate the application ID for your app, type:

  /opt/qradar/support/recon ps

1. A list of installed applications and their App-ID values are output to the screen. The App-ID is a unique numeric value. Administrators can use the numeric App-ID value to connect to the container for a specific application. If a failure is detected, remediation steps are displayed.
2. To connect to the app container, type:

  /opt/qradar/support/recon connect <App-ID>

1. A shell is opened to the application's container. Administrators can browse this directory to review files, logs, or configurations for the application.
2. After you enter the docker container, list the files in /etc/pki/ca-trust/source/anchors/ to verify the certificate exists.

  ls -l /etc/pki/ca-trust/source/anchors/