DX SaaS 26.8.1 - Certificate Authentication for Webhook Channels Enhanced to Address Vulnerability Issues

Products

• DX SaaS

Issue/Introduction

On reviewing the release notes for 26.8.1 on DX O2 SaaS I noticed the following

• Certificate Authentication for Webhook Channels Enhanced to Address Vulnerability Issues
  The Certificate Authentication in the Webhook channels now includes the option to provide the Server Trust Certificate that a client uses to verify the identity of the server it is connecting to. You can provide the server CA or self-signed certificate (PEM format) to verify the webhook endpoint and to achieve mutual TLS where both the client and server present and validate each other’s certificates.
  You can disable the Server Certification Validation if necessary. However, disabling a server trust certificate (or bypassing SSL verification) allows a client to connect to a server without verifying its identity. While the connection remains encrypted, it creates a severe vulnerability to Man-in-the-Middle (MitM) attacks, making it impossible to guarantee you are communicating with the intended server.
  The Certificate Authentication option is not available out-of-the-box. Contact Broadcom Support
  for assistance.
  
  

Can you confirm that this will not be enabled by default after this coming weekends release? Changes like this will require planning and testing on our side before any implementation.

Resolution

1. Yes, can confirm that after this weekend update there will be no changes in existing functionality/behaviour in webhooks.
2. If it is enabled customers will see options as below screenshot. If its not enabled,  then there is no change in UI.
3.