topic Re: How does a PA know which forward trust certiticate to use for a given decryption profile/policy in Advanced Threat Prevention Discussions

How does a PA know which forward trust certiticate to use for a given decryption profile/policy

GrantCampbell4 — Mon, 19 Jul 2021 14:46:56 GMT

Hello,

I have a Palo Alto 8.1.18 firewall that is already configured with a SSL Forward Proxy setup for a a current set of traffic. There is only one signed certificate that is configured as the Forwarding Trust and Forwarding Untrust certificate (odd I know), let's call it cert X.

I have a new set of traffic that requires SSL Forward Proxy treatment. Does the PA only allow the use of one Forward Trust/Untrust Certificate or can multiple certs be used? if so how does the PA know which certificate to call upon as I see no reference to a cert in the decryption profile, so does it cycle through say cert x, cert y and cert z until one matches?

Struggling to find anything useful on the PA site, so advice is greatly appreciated.

Regards

Re: How does a PA know which forward trust certiticate to use for a given decryption profile/policy

mivaldi — Wed, 21 Jul 2021 16:59:43 GMT

The decryption certificate is global, you cannot choose one per decryption profile. Whatever certificate you mark for Forward Trust, will be used for SSL Forward Proxy when the firewall verifies that the root CA that signed the server certificate is in the Trusted Root CA list, or present as Trusted Root CA in the certificate store. If the firewall cannot find it, it will instead use the certificate marked as Forward Untrust Certificate.

By the way, it is a BAD IDEA to mark both Forward Trust and Forward Untrust in the same certificate, because you will push this certificate to workstations as a certificate that your devices should trust. That means that if the firewall finds a server certificate that is not trusted, it will present the device with a certificate it trusts, and therefore make it seem to the end user that anything out in the internet is trusted, even when they browse to websites or use applications that present with invalid SSL certificates.

Re: How does a PA know which forward trust certiticate to use for a given decryption profile/policy

GrantCampbell4 — Thu, 22 Jul 2021 07:42:53 GMT

Mivaldi,

That's great feedback, thank you. That was my suspicion too but little PA clarity on their documentation.

I agree a single cert for both i not best practice, but we have inherited this as is. Look forward to putting it all right.

Regards