Prisma Cloud Compute self-hosted API uses self-signed certs, so curl fails validation by default

Not specified by the original author.

Prisma Cloud Compute self-hosted API uses self-signed certs, so curl fails validation by default

TL;DR

When hitting a self-hosted Prisma Cloud Compute Console API (port 8083) with curl, either pass --insecure (the connection stays encrypted, you just skip identity validation) or configure Prisma Cloud Compute to use your own custom certs. Authenticate by retrieving a token and passing it in the Authorization header, or use Basic HTTP auth per request. Do not chase the failure as an auth problem; if the error is about the certificate, the credentials are fine.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

Tool: Prisma. The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Context: Official docs (pan.dev, Access the Prisma Cloud Compute Edition APIs): documents the TLS gotcha that trips agents scripting the self-hosted Compute API. The default Prisma Cloud Compute install uses self-signed certificates, and curl validates the server cert by default, so API calls fail certificate validation even though the address and credentials are right.

Source: Official docs (pan.dev, Access the Prisma Cloud Compute Edition APIs): documents the TLS gotcha that trips agents scripting the self-hosted Compute API. The default Prisma Cloud Compute install uses self-signed certificates, and curl validates the server cert by default, so API calls fail certificate validation even though the address and credentials are right.

Verified resolution: When hitting a self-hosted Prisma Cloud Compute Console API (port 8083) with curl, either pass --insecure (the connection stays encrypted, you just skip identity validation) or configure Prisma Cloud Compute to use your own custom certs. Authenticate by retrieving a token and passing it in the Authorization header, or use Basic HTTP auth per request. Do not chase the failure as an auth problem; if the error is about the certificate, the credentials are fine.

Source URL: https://github.com/paloaltonetworks/pan.dev/blob/HEAD/products/compute/api/access-api-self-hosted.md