topic Re: can i use ssl decryption cert for web gui in General Topics

can i use ssl decryption cert for web gui

MP18 — Wed, 06 Feb 2019 20:11:06 GMT

we have ssl decryption enabled and using our own CA as Internal Root Certificate.

For webgui we get cert warning can i use same cert for Web gui to PA?

Re: can i use ssl decryption cert for web gui

rmfalconer — Wed, 06 Feb 2019 22:07:32 GMT

The cert you use for the gui will cause warnings for the same reason that any cert does. If the cert used for the gui is issued by an authority that your endpoint trusts, has the correct name and isn't expired, it shouldn't cause a warning.

For the gui, I create a cert with the firewall fqdn as the subject with SAN entries for the fqdn, firewall name and IP address. This tends to catch how we connect to the gui and eliminates errors.

Re: can i use ssl decryption cert for web gui

MP18 — Wed, 06 Feb 2019 22:10:15 GMT

i already have Trusted Root CA that all pc trusts.

SSL decrypt cert is created from the root as intermediate.

So ok to use that for gui?

Re: can i use ssl decryption cert for web gui

rmfalconer — Wed, 06 Feb 2019 22:44:10 GMT

You can use any certificate for the gui, just select it in the TLS profile you use for the web management. But if you re-use a cert that was meant for something else, you may still get warnings.

If the current cert has a subject of firewall.company.com and you access the gui with 10.1.1.1, you'll still get a warning from the browser since the address doesn't match the info on the cert.

Re: can i use ssl decryption cert for web gui

Abdul_Razaq — Thu, 07 Feb 2019 08:32:16 GMT

Yea..you can use it for GUI as well,

the certificate you are using for forward proxy should be a CA certificate ( certificate signing should be selected under key usage while generating certificate). once you select this certificate as forward trust/untrust, this certificate will be used for proxying accordingly.

The certificate used for web GUI need not to sign any other certificates, it just need to be end entity, even you can use a CA certificate as well for this purpose.

Just create a ssl/tls profile and call this certificate under. use this profile in management configuration.

Re: can i use ssl decryption cert for web gui

MP18 — Thu, 07 Feb 2019 12:54:25 GMT

I tried to use my current ssl decrtypt cert also as web gui

then i login to PA it still gives me warning message not trusted?

Re: can i use ssl decryption cert for web gui

Abdul_Razaq — Thu, 07 Feb 2019 13:52:56 GMT

Hi @MP18 ,

certicate error can be because of

Not issued by trusted CA
Issued to someone else ( cn mismatch)
expired...etc

About decryption certificate,

please note that you wil get certificate error if the certificate was note issued by a trusted root CA by your browser/PC.

As no CAs will be providing a certificate with CA flag ( capable of signing certificate) because of security reasons, you will be generating this in PA, which means it is self signed, so it is not trusted by any browser/machine otherthan this PA unless you manually import this cert in PC/browsers trusterd authority.

so when you use this cert for web GUI, it is expected that you will get the error. you can just use it

If you want a trusted certificate for your web access to avoid warning, you can get it from any of trusted CA, need put one of fqdn/ip in common name field, add other one alternative name. import in palo alto, use it for web access. this is cost involved..

Re: can i use ssl decryption cert for web gui

rmfalconer — Thu, 07 Feb 2019 16:57:33 GMT

What are the common name and the SAN entries for the certificate? Do any of those match the URL of the web GUI?

Re: can i use ssl decryption cert for web gui

MP18 — Thu, 07 Feb 2019 19:54:54 GMT

No common name does not match the webgui for the firewall.

SSL decryption has different common name

Re: can i use ssl decryption cert for web gui

rmfalconer — Thu, 07 Feb 2019 20:38:40 GMT

Then the warning is expected. As I said previously, the browser will give a warning if the proper name or IP address is not the CN or included as a SAN entry.

Re: can i use ssl decryption cert for web gui

MP18 — Fri, 08 Feb 2019 03:38:04 GMT

Many Thanks for help