topic Re: about certificate expired date in General Topics

about certificate expired date

paloalto.netfos — Wed, 05 Dec 2012 17:00:14 GMT

Hi All,

Is there any way to custom certificate expired date that generate by paloalto itself ? I saw it on webpage that is too short, it only have six monthes.

Thanks.

Regards,

Joy

Re: about certificate expired date

gwesson — Wed, 05 Dec 2012 20:12:18 GMT

Hi Joy,

If you are running version 5.0.0 or higher, you can specify the expiration in the Generate dialog box.

If you are running a version prior to 5.0.0, there is no way to customize the expiration date directly on the firewall. You can create the certificate externally (OpenSSL, Microsoft Certificate Server, etc.) and import the private & public keys. Those externally-generated certificates can use any expiration you would like.

I am not sure why you are seeing a 6 month expiration date though. On 4.1.9, the default expiration date for a newly created certificate is ten years.

Regards,

Greg Wesson

Re: about certificate expired date

mikand — Wed, 05 Dec 2012 22:14:35 GMT

Also is this question regarding the https for mgmt-plane or certificates generated on the fly when you use ssl decrypt?

If its the later then the PA will just copy the expiration date from the external cert into the internal (on the fly generated) cert. This internal cert is then signed by the CA you imported into the PA (and the client have this CA public cert added as trusted CA).

Re: about certificate expired date

paloalto.netfos — Sun, 09 Dec 2012 09:51:00 GMT

Hi Greg,

Thanks for reply, I saw a 6 month expiration date on client IE browser, but truly, it shows 10 years expiration date on PA after I generate it, it's the point that I confuse.

In addition, the PA is running PanOS 4.1.9.

Regards,

Joy

Re: about certificate expired date

gwesson — Mon, 10 Dec 2012 23:42:22 GMT

Hi Joy,

If you are doing SSL Decryption as mikand says, the certificate that the firewall presents is just copied from the server. The domain name (common name) and expiration date (validity period) are copied from the destination server's certificate, with the issuer being the Palo Alto Networks firewall.

If you are managing the firewall and seeing the 6-month expiration date, that is something I have not seen. I doubt your PC date is wrong or you would have errors on nearly every public HTTPS site. You could always regenerate the certificate, but it sounds like you already verified it is a 10-year cert.

Can you give us more details about what the certificate is used for and when you see it?

-Greg

Re: about certificate expired date

paloalto.netfos — Wed, 12 Dec 2012 01:36:42 GMT

Hi Greg,

Thanks for reply, after confirm it again, I see the correct info about expiration date that is 10 years. the 6 month expiration date that I saw should be signed from PA for client use.

I am sorry about that, and thanks for your helping.

Regards,

Joy