topic SSL Forward Proxy Decryption with ECDSA Cert? in General Topics

SSL Forward Proxy Decryption with ECDSA Cert?

jsalmans — Mon, 12 Dec 2016 14:35:05 GMT

Just wondering if it's possible to use an Elliptical Curve DSA cert with CA and Trusted Root to be the Forward Trust Certificate for the SSL Forward Proxy decryption feature?

Reading about the Perfect Forward Secrecy feature here:

https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/decryption-features/perfect-forward-secrecy-pfs-support.html

It would seem like ECDSA certs are supported in use with Forward Proxy SSL decryption but, when I generate a cert, the Forward Trust and Forward Untrusted check boxes are greyed out.

I'm on release 7.1.6

Thanks!

Re: SSL Forward Proxy Decryption with ECDSA Cert?

fozail — Wed, 14 Dec 2016 07:58:00 GMT

Hi,

The certifiacte you have genearted on PA has CA enbaled, I mean did you make it as CA to be used for Decryption. If it is a CA you should see that Forward Trust option is highlighted.

Best Regards,

Fozail

Re: SSL Forward Proxy Decryption with ECDSA Cert?

JacobAn — Wed, 20 Jun 2018 15:09:21 GMT

As already mentioned, making sure the CA box is checked is critical.

In verison 8.0, you weren't able to use ECDSA effectively until version 8.0.9 as newer browsers were unhappy about a null trailer in the resigned certificates from the firewall.