Description

This article explains what all URLs need to be whitelisted in a proxy server to allow the connection through to the skyATP

Symptoms

SkyATP enrolment fails on the SD as PE with exit code status 95.

Error log seen in the controller.log:

controller: [06/30/2026 06:50:56] [DEBUG] [http_utils] [7f7311315000] - {'feedSources': {'uri': '/api/v2/controller/feedSources', 'feedSource': [{'id': '4abd33c1-8bd8-485f-94a4-15bbe2826f1a', 'name': '', 'domain': '', 'feedSourceType': 'skyatp', 'authMode': 'token', 'token': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJlbWFpbCI6ImRsLnNucy5zZWN1cml0eS5ydW5Ad2VzdHBhYy5jb20uYXUiLCJ0b2tlbl9pZCI6IjRjYjk5ZGE0LTRmMjgtNDQ2OC05MjI5LThiYjgwN2RhMTc5NSIsInRva2VuX25hbWUiOiJ3YmMtYXBhYy1za3lhdHAtbm9ucHItc2QtMjQ4Njg2NCIsImFjY2Vzc19ncm91cHMiOlsiU2VjdXJpdHkgRGlyZWN0b3IiXSwiZXhwIjoxODE0MDIyODY2LCJnZW5pZCI6InFkeFVhcXNZY3RsY0xqdHRoN3RPY3hTZFgwcllOWGtGS1l2ZGV1WWZYSmlWWmNNTTRtMy9XRjZzOWxGV3NJVy9tcXk1dkNuTHBLcFFlNnFlcWljNVlZbVlTcWRvQVZyTDA3K2tHcURrLzRJPSJ9.gyCXmmWPWF1v_HN20bKhxQobbBlsMYrc2cGQd_LP0nc', 'region': 'apac', 'feedSourceUrl': 'https://apac.sky.junipersecurity.net/', 'updateTs': 1782487066, 'enrollStatus': 'FAILURE', 'statusReason': "CalledProcessError Command '['bash', '/opt/policy-enforcer/srv/feeder/scep/getClientCert.sh', '-s', '/opt/policy-enforcer/srv/feeder/scep', '/tmp/4abd33c1-8bd8-485f-94a4-15bbe2826f1a.1782486867.9903948', 'kgdg8x0so4onpjkn:PolicyEnforcer:UNF00A88B978', 'n8bsbjz52gscea87', 'http://ca.junipersecurity.net:8080/ejbca/publicweb/apply/scep/SRX/pkiclient.exe', 'skyatp']' returned non-zero exit status 93.", 'ipv6Enabled': False, 'tokenStatus': 'VALID', 'tokenExpiration': 1814022866, 'tokenId': '4cb99da4-4f28-4468-9229-8bb807da1795', 'enrolledDeviceCount': 0, 'feedStatus': []}], 'total': 1}}

Proxy server logs show that the connection has been rejected.

Solution

In an application flow, we can't realistically predict every URL that may be accessed. Some URLs are discovered dynamically, and others contain dynamic values. Requiring full URL whitelisting isn't viable or scalable and could lead to similar issues elsewhere in the application.

Please have the following URLs whitelisted in the proxy server for the SkyATP to get the enrolled in the SD.

http://ca.junipersecurity.net/*

http://ca.junipersecurity.net:8080/*

http://va.junipersecurity.net/*

and ensure Global Pattern match is enabled for these.


This will allow the certificates to be accessible for the SkyATP enrolment in SD.





Modification History

2026-07-03 : Article Created