topic Re: How To use Certificate For Secure Web-GUI Access HA pair in Next-Generation Firewall Discussions

How To use Certificate For Secure Web-GUI Access HA pair

Doyenadmin — Fri, 17 Nov 2023 07:18:13 GMT

Dear All,

referred below link for Secure Web-GUI access, successfully done with my primary firewall, how can i achieve this when i have firewall in HA?

How To use Certificate For Secure Web-GUI Access - Knowledge Base - Palo Alto Networks

I will be using a self-signed certificate. and will distribute and install that certificate to necessary management systems only.

regards,

Re: How To use Certificate For Secure Web-GUI Access HA pair

aleksandar.astardzhiev — Fri, 17 Nov 2023 13:35:33 GMT

Hi @Doyenadmin ,

Check the following discussions where similar question was asked:

LIVEcommunity - Certificates duplicated from Primary to Secondary firewall in Palo alto - LIVEcommunity - 522689 (paloaltonetworks.com)

Solved: LIVEcommunity - SSL certificate for passive firewall - LIVEcommunity - 475947 (paloaltonetworks.com)

TL;DR - certificate is not synchronized so you need to import it separately on both members. However you must use the same name (no cert CN, but name for the cert when importing it to the config). You can choose to use separate certificates with different CNs for each member, or single cert using SAN or wildcard.

Re: How To use Certificate For Secure Web-GUI Access HA pair

Doyenadmin — Mon, 20 Nov 2023 05:23:26 GMT

Thanks @aleksandar.astardzhiev for the inputs.

I'll try this out and update you on this.