Adding an External Dynamic List Object and importing the Intermediate CA certificate from the external web server that the EDL is hosted on

user9891 — Wed, 15 Feb 2023 22:57:26 GMT

I am trying to add an External Dynamic List to our PA-440.

The External Dynamic List is hosted on an external web server by one of our security partners. This web server is https enabled and authentication is via username/password. This is the screenshot when you go to the EDL's Source URL:

According to this documentation, in order for the firewall to authenticate to this server, I will need to add the Intermediate CA certificates that match the certificates installed on the server the firewall is authenticating. With that profile, I will have the option to add a username and password to the External Dynamic List object when I add the correct Certificate Profile.

Here is the documentation that states I need to add the Intermediate CA certificates that match the certificates installed on the server the firewall is authenticating:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/configure-the-firewall-to-access-an-external-dynamic-list

My understanding of this is I needed to:

Download the Intermediate CA certificate from the external web server that's hosting the EDLs
Import this Intermediate CA certificate into the Certificate Manager
Create a Certificate Profile to add to the EDL object.

Downloading the Intermediate CA Certificate:

To download the Intermediate CA certificate from the external webserver that's hosting the EDLs.

Click the lock icon:

Click on "Connection Secure":

Click on "More Information":

Click "View Certificate":

Click the middle certificate (the Intermediate CA), scroll down and download the cert file (.PEM)

> Is this the correct file to be downloading?

> The UserTrust CA is already in the list of Trusted Certificate Authorities in the Certificate manager of the PA-440, so this Intermediate CA Certificate is all I should need.

Re: Adding an External Dynamic List Object and importing the Intermediate CA certificate from the external web server that the EDL is hosted on

TomYoung — Thu, 16 Feb 2023 03:14:08 GMT

Hi @user9891 ,

Yes, that process is correct. The document actually says to add the root and intermediate to the certificate profile. That is the process that I use, and it works. Your reasoning makes sense that the root is already trusted. Let us know if only the intermediate CA works in the certificate profile.

Thanks,

Tom

topic Re: Adding an External Dynamic List Object and importing the Intermediate CA certificate from the external web server that the EDL is hosted on in Next-Generation Firewall Discussions

Adding an External Dynamic List Object and importing the Intermediate CA certificate from the external web server that the EDL is hosted on

Downloading the Intermediate CA Certificate:

Re: Adding an External Dynamic List Object and importing the Intermediate CA certificate from the external web server that the EDL is hosted on