topic Re: External CA Certificate Options Greyed Out in General Topics

External CA Certificate Options Greyed Out

Jack_Howells — Thu, 14 Apr 2016 10:44:33 GMT

Hi guys,

I've followed the documentation on how to generate a CSR (https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Generate-a-CSR-Certificate-Signing-Request-and-Import-the/ta-p/53593) but when importing the certificate I'm only able to select one option, as shown below.

Could you please help explain why they're greyed out?

Thanks

Re: External CA Certificate Options Greyed Out

Jack_Howells — Thu, 14 Apr 2016 10:45:07 GMT

Edit:

I'm trying to use this External CA for SSL Forward Proxy.

Re: External CA Certificate Options Greyed Out

gwesson — Thu, 14 Apr 2016 17:16:19 GMT

Your images didn't come through for some reason, but in general the reason for this is because the CSR wasn't signed with the CA option (ca=true). If it's not a CA cert, it cannot be used for forward decryption.

You will be unable to get a CA cert from a public authority (like Symmatec or GoDaddy). No public CA will give a private party a certificate that can be used to issue new, trusted certificates.

You'll need to use an internal CA, or create a self-signed CA cert on the firewall and distribute that to your users.

Cheers,

Greg

Re: External CA Certificate Options Greyed Out

Jack_Howells — Thu, 14 Apr 2016 21:57:33 GMT

Ah that's a shame.

I'm sure I can use an External CA for SSL Forward Proxy, I just needed to mark the certifcate as the Trusted Root CA, as well as Forward Trust and Untrust. This wasn't done and should work otherwise..?

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/decryption/configure-ssl-forward-proxy

Regarding the screenshots, I had tried to edit the subordinate certificates which you can't change as they're generated off of the back of the Trusted Root cert.

Thanks
Jack

Re: External CA Certificate Options Greyed Out

Raido_Rattameister — Fri, 15 Apr 2016 10:01:08 GMT

For firewall to be able to sign certificates on the fly for forward proxy to work you need CA or intermediate CA certificate.

Public CA's will not allow you to be their intermediate because this would completely brake SSL model (you could decrypt anyones SSL traffic).

For that reason you either generate CA and push it out with Group Policy or generate CA certificate and sign it with your domain CA (then root will be domain CA and fw cert will be intemediate).

If you take second path then you don't have to push fw cert to anyware as your domain computers already trust domain root CA.