Certificates on Palo alto - Types to be installed

N-Open — Sun, 03 Dec 2023 09:07:28 GMT

Dear memebers,

We are going to use palo alto vm series firewall on Azure and like to take your advice on the type of certificates to be installed. The firewalls will be public facing front end by Azure application gateway.

The FW will be protecting a web site running on the background. If my understanding is correct, I need 2 types of certificates.

One from Certificates from a trusted third-party CA (Go dady/Verisign) - This is for web site
Obtain a Certificate from an External CA - This will be from Palo alto itself for SSL/TLS decryption

plz advice if my understanding is correct.

Re: Certificates on Palo alto - Types to be installed

reaper — Mon, 04 Dec 2023 14:07:32 GMT

you don't need the second ssl certificate as that is only required for outbound proxy inspection (and it needs to be from an internal PKI or selfsigned instead of a public one)

for inbound inspection, you need to have the server certificate (and preferably the CA/root and intermediate, to complete the certificate path)

you can use the server certificate on the firewall (WITH private key) to look inside the flow

topic Re: Certificates on Palo alto - Types to be installed in VM-Series in the Public Cloud

Certificates on Palo alto - Types to be installed

Re: Certificates on Palo alto - Types to be installed