topic Re: Impact after Changing the key size setting clears the current certificate cache. in Next-Generation Firewall Discussions

Impact after Changing the key size setting clears the current certificate cache.

JiaXiang — Thu, 14 Sep 2023 06:04:08 GMT

Due to VA Scanner scan my firewall having vulnerabilities of SSL Certificate Chain Contains RSA Keys Less Than 2048 bits .

So I plan to follow below KB to change the key size.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management/configure-the-key-size-for-ssl-forward-proxy-server-certificates

In the KB mentioned as below, may I know clear the certificate cache will have any impact ? and change the keysize require to reboot firewall ?

Changing the key size setting clears the current certificate cache.

Re: Impact after Changing the key size setting clears the current certificate cache.

aleksandar.astardzhiev — Thu, 14 Sep 2023 09:20:49 GMT

Hi @JiaXiang ,

I believe you are not interperting the findings from your VA scan properly.

The link you mentioned will effect how PAN firewall is performing SSL decryption, while I am expecting your VA scan to have report that PAN firewall admin WebUI is using server cert with short key. What you are probably looking for is here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

Re: Impact after Changing the key size setting clears the current certificate cache.

JiaXiang — Fri, 15 Sep 2023 00:29:59 GMT

Thanks for sharing if follow the KB steps to disable the weak cipher . Require to reboot the firewall ? what is the impact if currently I have certificate is using one of the weak cipher ?

Re: Impact after Changing the key size setting clears the current certificate cache.

aleksandar.astardzhiev — Fri, 15 Sep 2023 07:03:19 GMT

Hi @JiaXiang ,

I haven't done this procedure yet, so I am not completely sure. But I am almost certain that it doesn't require reboot, why:

- WebUI is controlled by the management plane.

- Here you can see the process responsible for serving the admin webui - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO

- I would assume changing the ciphers will require restart only for that particular process, which has nothing to do with the dataplane - which is reponsible for processing traffic.

Based on the above I am almost certain that applying the changes will not have any effect on forwarded traffic. Only the current admin sessions using the WebUI will be closed (while process restart). Admin SSH sessions probably wouldn't be affected as well.

Re: Impact after Changing the key size setting clears the current certificate cache.

JiaXiang — Fri, 15 Sep 2023 07:25:24 GMT

Thank you, I test first .