Technical Tip: Remote shell functionality in on-premises environments was disrupted due to certificate expiration

[ikish]

Description	This article describes how to replace an expired certificate in an on-premises Remote Shell deployment.
Scope	Threat Hunting Repository version MW-7.2.0.0057_STR-6.0.1.0007 and below.
Solution	To deploy the fix of replacing the expired Remote Shell certificate,  follow the steps below: Deliver the 'RSHELL_CERT.tar' file, which can be provided by TAC upon request, to the THR machine. Log in to the THR machine using SSH and extract the RSHELL_CERT.tar file: tar xvf RSHELL_CERT.tar Change directory to the 'remote_shell_cert ' folder: cd remote_shell_cert Execute the script for replacing the certificate in the 'remote shell' deployment: bash replace_cert.sh Wait for the output: Patching Remoteshell secret... secret/edr2-onprem-remoteshell-certs patched Restarting Remoteshell deployment... deployment.apps/edr2-onprem-remoteshell restarted Successfully patched secret and restarted deployment. Make sure that a new 'remoteshell' pod has been created using the command: kubectl get pods -n edr2-onprem Validate that the remote shell functionally to the collectors is available again.