topic is it possible to add a CA in PA device? in General Topics

is it possible to add a CA in PA device?

willstech — Fri, 13 Jul 2012 06:00:00 GMT

Hello there.

I have a question related to CA for SSL client.

Customer has a certificate which issued by Trusted Root CA, but this trusted root CA is not contained in an ssl client's browser.

And then, the customer certificate was issued by this CA.

So, customer wants to distribute a CA of customer for all SSL VPN clients to avoid ssl certification error. (it was not created by a PA device.)

I tried to import to the CA at certificates in Device tab, but it was impossible.

Is it possible to do it through PA device?

Please let me know someone who know about it.

Thanks,

Eugene.

Re: is it possible to add a CA in PA device?

mikand — Fri, 13 Jul 2012 07:44:01 GMT

There is a trusted CA list within the device but I cant find in the manuals on how to list its content nor how to add your own CA's to this list - perhaps somebody else in here who knows?

Regarding importing of stuff, if the web-gui fails you can use scp or tftp like so:

scp import certificate from user1@10.0.3.4:/tmp/certificatefile

tftp import ssl-certificate from user1@10.0.3.4:/tmp/certificatefile

Re: is it possible to add a CA in PA device?

jdelio — Thu, 19 Jul 2012 20:30:41 GMT

Through the Webui -> Device -> Certificates .. that shows all of the certs there.

You can take public CA certs and import them with their Key files.

OR you can create local generated CA's,. or the actual SSL certs..

It honestly really depends on what you are trying to accomplish.

Re: is it possible to add a CA in PA device?

mikand — Thu, 19 Jul 2012 20:55:31 GMT

I hope you mean the public key when you spoke about public CA certs because I seriously doubt they will or should release their private key 😉

Regarding that cert list I have completely missed that, in which version did that show up (and whats the CLI commands to list and modify it)?

Device -> Certificate Management -> Certificates -> Default Trusted Certificate Authorities (tab)

Re: is it possible to add a CA in PA device?

zarina — Fri, 20 Jul 2012 00:59:03 GMT

As of 4.1, we do not list the trusted certs that are used by PAN. The tab "Device -> Certificate Management -> Certificates -> Default Trusted Certificate Authorities" is an new feature added in 5.0.

To generate a cert through CLI:

request certificate generate <options>

To modify the cert:

set shared certificate <options>