Automate importing of certificate in broken certificate chain

Tralna — Sun, 19 Jun 2022 22:54:46 GMT

Hey all,

Referring to this article https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/repair-incomplete-certificate-chains we are looking at whether importing intermediate certificates when this error is seen can be fully automated. Im thinking it would be possible to do this with log forwarding and then a script that downloads the certificate from the url in the log entry and imports it to Panorama with the XML API.

Has anyone tried implementing this before and is willing to share your method/script?

thanks.

Re: Automate importing of certificate in broken certificate chain

JimmyHolland — Mon, 12 Sep 2022 16:43:17 GMT

Hi @Tralna, I have not seen any scripts, but I have seen customer using Cortex XSOAR to perform this, using the exact logic you described; trigger from the decryption logs, get the cert, upload to PAN-OS, fixed. Depending on usage limits, XSOAR Community Edition could potentially do this for free (https://start.paloaltonetworks.com/sign-up-for-community-edition.html).

topic Re: Automate importing of certificate in broken certificate chain in Automation/API Discussions

Automate importing of certificate in broken certificate chain

Re: Automate importing of certificate in broken certificate chain