Accessing SUSE Customer Center and SUSE registry behind a firewall and/or through a proxy

Domain/Host Name Allowlisting

* The firewall needs to allow connections to the following domains (for both ports: 80 and 443):

IP Address Allowlisting

* If IP address allowlisting is needed, the current list of IPs for updates.suse.com / installer-updates.suse.com is:

* The current list of IPs for scc.suse.com and registry.suse.com are: 

* Static assets and support case attachments are served via AWS CloudFront.
CloudFront IP addresses may change over time. 
The current list of possible IP addresses can be obtained as follows:

- CloudFront (customer-uploads.suse.com, registry-storage.suse.com, static.scc.suse.com)

$ curl https://ip-ranges.amazonaws.com/ip-ranges.json -o ip-ranges.json

$ jq -r '.prefixes[] | select(.service=="CLOUDFRONT") | .ip_prefix' < ip-ranges.json | sort

For reference, AWS (Amazon Web Services) publishes its current IP address ranges in JSON format. To view the current ranges, download the .json file at: AWS IP address ranges  (https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html)



Proxy Setup

* A Proxy needs to allow for the "Authorization" and "System-Token" headers to be passed to the SUSE Customer Center.
Whether a proxy is filtering these headers can be checked with:

$ curl -X POST -H "Authorization: Basic dXNlcjpwYXNzd29yZA==" -H "System-Token: testtoken" https://scc.suse.com/debug/reflect

The output of the command should contain the values for HTTP_AUTHORIZATION and HTTP_SYSTEM_TOKEN that were provided in the command.


* Verify the proxy doesn't break the certification or a certificate wasn't installed correctly

$ openssl s_client -connect scc.suse.com:443 -showcerts -servername scc.suse.com

This should return "CONNECTED" and a successful SSL handshake. If it doesn't, the SUSE Knowledge Base article "How to verify openssl certification chain" can be used to check and debug the certificate status.