Unable to verify app details when using CA PFX certificate for Microsoft Teams Content Inspection CASB

Products

• CASB Securlet SAAS
• CASB Advanced Threat Protection
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

When rotating or swapping from self-signed certificate to a CA cert for Microsoft Teams Content Inspection (Custom OAuth Application) in CloudSOC, administrators may encounter the error "Unable to verify app details" after clicking the Validate button. This issue typically prevents the successful update of the private key and thumbprint, even if the Tenant ID and Client ID remain unchanged. This article provides the necessary OpenSSL commands to ensure the certificate and private key are in the specific formats required by the CloudSOC portal.

Environment

• Product: Symantec CloudSOC (CASB)
• Feature: Microsoft Teams Securlet / Content Inspection (Custom OAuth)
• Certificate Key Size: 4096-bit (or 2048-bit)

Cause

The "Unable to verify app details" error (HTTP 400) is caused by one or more of the following:

1. Incorrect Private Key Format: The private key uploaded is not in the PKCS1 standard or is missing required PEM headers.
2. Incorrect Certificate Encoding: The public certificate (.crt) was extracted in ASCII format instead of the required Binary (DER) format.
3. Incorrect Thumbprint: The thumbprint used was copied directly from the Azure/Entra ID portal instead of being manually calculated as a Base64-encoded binary SHA1 hash of the DER-encoded certificate.

Resolution

To resolve this error, re-extract and convert your certificate components using the following steps:

1. Extract the Private Key in PKCS1 Format

CloudSOC requires the private key to be in PKCS1 standard. Use these commands to convert your .pfx file:

# Extract the key from the pfxopenssl pkcs12 -in your_cert.pfx -nocerts -nodes -out temp_key.pem # Convert to PKCS1 RSA formatopenssl rsa -in temp_key.pem -out teams_private_pkcs1.pem

Verify that teams_private_pkcs1.pem starts with -----BEGIN RSA PRIVATE KEY-----.

2. Extract the Public Certificate in Binary (DER) Format

The thumbprint must be calculated from a binary DER-encoded file:

# Extract the public cert to PEM firstopenssl pkcs12 -in your_cert.pfx -clcerts -nokeys -out temp_cert.pem

# Convert the PEM certificate to Binary (DER) formatopenssl x509 -in temp_cert.pem -outform DER -out teams_public_binary.crt

3. Calculate the Binary SHA1 Thumbprint

Generate the Base64-encoded thumbprint required for the CloudSOC portal configuration:

openssl dgst -binary -sha1 teams_public_binary.crt | base64

4. Update CloudSOC Portal

1. Log in to CloudSOC and navigate to the Teams Securlet configuration.
2. Edit the Custom OAuth section.
3. Upload the teams_private_pkcs1.pem file created in Step 1.
4. Paste the Base64 string generated in Step 3 into the Thumbprint field.
5. Click Validate.

Additional Information

• For official documentation on Teams remediation options, see Microsoft Teams Content Inspection.