topic Re: Cannot locate certificate from search function in General Topics

Cannot locate certificate from search function

Farzana — Sun, 06 Aug 2017 23:42:56 GMT

Hello,

Before deleting I tried to check if the certificate is used anywhere else using the search function and it shows me the result below.

When I select the text line (member...) it does not provide any further information nor takes me where it is located.

Using PAN-OS 7.1.0.

Any idea where to find the text?

Thanks in advance.

Re: Cannot locate certificate from search function

BPry — Mon, 07 Aug 2017 16:39:00 GMT

@Farzana,

Some quick investigation on my firewall would point to it picking up the following line.

 </mgt-config>
  <shared>
    <ssl-decrypt>
      <ssl-exclude-cert/>
      <trusted-root-CA>
        <member>WSL Root</member>
        <member>WSL Issuing</member>
      </trusted-root-CA>
    </ssl-decrypt>

I wouldn't be concerned about it

Also just verified that on 8.0.4 at least the issue is fixed and I don't see the 'other' section on the exact same config file.

Re: Cannot locate certificate from search function

Farzana — Fri, 22 Sep 2017 06:50:57 GMT

Hi @BPry

I just want to ask the question if we are not upgrading the box what is the best way to delete the certificate?

This is a trusted root CA cert and not expired yet.

We tried the suggestion below but did not work.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Delete-Certificates-on-a-Palo-Alto-Networks-Firewall/ta-p/61867

Re: Cannot locate certificate from search function

BPry — Fri, 22 Sep 2017 18:05:37 GMT

@Farzana,

I'm actually not running 7.1 on anything anymore so I'm not entirely sure. You should have been able to run the following

> configure

# delete shared ssl-decrypt trusted-root-CA "TUH Network CA"

and delete the CA cert, which if I've identified where this was coming from correctly should remove the listing completely. If you run "show shared ssl-decrypt trusted-root-CA" and hit tab, do you see the TUH Network CA listed at all?