topic PA-1410 / PAN-OS 11 doesn't include many MS Root CA's in Next-Generation Firewall Discussions

PA-1410 / PAN-OS 11 doesn't include many MS Root CA's

brucegarlock — Mon, 11 Sep 2023 14:19:04 GMT

We do TLS decryption, and cutover a site to new PA-1410's running 11.0.2. While testing MS updates on endpoints, we were getting notifications that the client couldn't contact the update server. Looking in the decryption log, none of the calls to the MS URL's were trusted. I looked at the default included trusted CA's from our 820's that were are moving from, and sure enough, many of the MS root CA's are not imported into PAN-OS 11.x. I exported ones missing from our 820's and imported into the 1410's and marked them as trusted to work around this. Why would PAN not include these?

Here's the default trusted CA's from our 820's running 10.1:

Here's what was default on the 1410's:

Re: PA-1410 / PAN-OS 11 doesn't include many MS Root CA's

akuzhuppilly — Tue, 12 Sep 2023 02:26:06 GMT

Hello @brucegarlock

The PA default trusted certificate authorities store is updated in major releases.

This means, it may (or may not) have different certificates in 10.1.x and in 11.0.x

You can upload the necessary certificates to the device certificate store and mark them as trusted.

Re: PA-1410 / PAN-OS 11 doesn't include many MS Root CA's

brucegarlock — Thu, 14 Sep 2023 12:01:30 GMT

Yes, this is what I am doing, but what I don't understand is why those were not included as defaults like they were in the older models. It seems like a lot of the default CA's included in previous PAN OS versions are not included on 11.x