topic Re: Certification expiration alert in General Topics

Certification expiration alert

g-crisostomo — Thu, 19 Jan 2023 18:27:28 GMT

Is there a way to generate alerts for certificates which are about to expire?

I mean, for certificates installed and used for example for GlobalProtect, SSL decrypt and etc...

Re: Certification expiration alert

PavelK — Thu, 19 Jan 2023 20:57:55 GMT

there is a KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POWJCA4&lang=en_US%E2%80%A9 with instructions how to enable certificate expiration check.

Unfortunately, I have a mixture of feelings about this feature. While I have not seen anybody complaining about this not being working properly, at least in my case it did not trigger any alert. After several month long TAC ticket, TAC engineer confirmed they could eventually reproduce it, but not planning to address this issue. It was flagged instead as an enhancement request instead of a bug.

Kind Regards

Pavel

Re: Certification expiration alert

g-crisostomo — Thu, 23 Feb 2023 13:55:56 GMT

Yeah, I checked and there's no way to the verify the expiration of certificates imported on firewall.

Thanks for the help.

Re: Certification expiration alert

domari — Fri, 23 Aug 2024 20:54:35 GMT

The "Certificate expiration check" is specifically to check the expiration of the device certificate. It will not generate a warning message for any other certificate except the device certificate for the firewall or Panorama.