Decryption with Elliptical Curve DSA PAN -OS 8.0.x

DonohoeRobert — Mon, 25 Sep 2017 08:49:01 GMT

Hi Team,

New features and improvement in version 8 allows for additional cipher algorithms to be decrypted and the re-encrypted to check for malicious content.

Can generate a self-signed or a cert off MS Certificate Authority.

Many customers have the decryption cert with the RSA Algorithm already configured. Need to set up the additional one as below to take advantage of the new feature. So will have two forward trust and two forward untrust.

The ECDSA one is then preferred and the PAN device will fail back to the RSA one if required.

To generate a self signed one, is simple enough, just select the different algorithm as below.

Done some tests with same recently and seems to be working ok, if any trouble with same contact your support provider,

Cheers,

Rob

Re: Decryption with Elliptical Curve DSA PAN -OS 8.0.x

Remo — Mon, 25 Sep 2017 10:02:27 GMT

FYI: There is no need to generate a new Root Cert with an EC Key. PAN-OS 8 allows you to decrypt connections to websites with ECDSA certs also with an RSA Decryption certificate.

--> For example: https://ecdsa.scotthelme.co.uk/

topic Decryption with Elliptical Curve DSA PAN -OS 8.0.x in General Topics

Decryption with Elliptical Curve DSA PAN -OS 8.0.x

Re: Decryption with Elliptical Curve DSA PAN -OS 8.0.x