topic Auto update of trusted root CA in General Topics

Auto update of trusted root CA

Farzana — Fri, 23 Feb 2018 04:44:17 GMT

Hello,

Our PANs are not updating the list of trusted root CA certificates which is causing issues with services such as Microsoft Skype for Business and other applications as we have SSL decryption enabled. Using PAN-OS 8.0.7

For example, Microsoft uses certificates signed by DigiCert Baltimore Root. I've checked on Panorama, our DC PANs and our site PANs and none of them have this root CA installed.

The enterprise CA & sub-ordinate CA certificates are working fine.

The issue is with common public trusted CA providers such as DigiCert root CAs not being trusted on the PANs. When these are not trusted by the PAN, SSL decryption breaks for the end user.

Can you please advise as to how we can have these root CA certificates updated automatically?

Thanks in advance.

Re: Auto update of trusted root CA

rmfalconer — Sat, 24 Feb 2018 01:17:17 GMT

I'm pretty sure the list of default root CAs only update when you upgrade PAN OS. I don't think they are rolled into any updates.

I'm running 8.0.6 and I have Baltimore_CyberTrust_Root included.

Re: Auto update of trusted root CA

semzurita — Fri, 02 Aug 2019 21:48:15 GMT

I had this issue as well with BitBucket and some other sites I was on code 8.0.7 and upgraded to 8.0.16 and the issue was resolved. I got communication from a Sr DE that there is a refreash feature for the certificate trust list CTL of root CAs in the 8.1 code https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/networking-features/refresh-of-default-trusted-cas#

-Manny