topic Re: PAN and intermediate CAs in General Topics

PAN and intermediate CAs

santonic — Thu, 27 Oct 2022 11:29:55 GMT

Last couple of days I've had quite a few cases where I had to manually add intermediate CAs as a Trusted Root CA in order for decryption to work (for customers blocking untrusted CAs already on firewall).

These are quite well known intermediate CAs like:

DigiCert TLS RSA SHA256 2020 CA1

GeoTrust RSA CA 2018

Entrust Certification Authority - L1K

Entrust Certification Authority - L1M

GEANT OV RSA CA 4

How come PAN's trusted Root CA list is lacking so many? How is it updated? Via content updates? I have content updates schduled daily.

Anyone else having issues with this? I know there was only some to add in the past. But last couple of days I really had many to add at different customers.

Re: PAN and intermediate CAs

JayGolf — Wed, 02 Nov 2022 07:41:55 GMT

Hi @santonic ,

I found this regarding int-CAs "the firewall does not trust intermediate CAs by default because intermediate CAs are not a part of the chain of trust between the firewall and the trusted root CA. You must manually add any intermediate CAs that you want the firewall to trust, along with any additional trusted enterprise CAs that your organization requires" from Manage Default Trusted Certificate Authorities.

Re: PAN and intermediate CAs

santonic — Wed, 02 Nov 2022 09:31:30 GMT

Hey @JayGolf

Thank you for reply and useful info. But it still seems a bit strange; almost every (if not every) website is signed by intermediate CA. After implementing and testing decryption (with certificate checks on PA) everything worked without adding any intermediate CAs. So are some intermediate CAs already included as Trusted CAs? Of course we didn't try every possible website but we didn't notice any issues then on websites we tried.

Then last week there were suddenly lots of cases of having to import Intermediate CAs.

And let's take for example google.com. It's signed by intermediate CA "GTS CA 1C3" which i never manually imported and is not among Default Trusted CAs. But i'm pretty sure the customer can access it otherwise they would report it ages ago.

So what is the actual story with trust for Intermediate CAs?