Generating SSL Decryption Forward Trust Cert for an HA Pair via Panorama?

Thomas_Dzubin — Mon, 09 Dec 2019 18:53:31 GMT

I've successfully rolled out SSL Decryption on a bunch of non-HA firewalls via Panorama. Generating the .CSR, signing it with my CA, and then importing the .CER but I'm wondering if this is going to work with my HA Pair because I'm guessing that I'll have to have two different certs because there's two different physical boxes. Has anyone done this before?

Re: Generating SSL Decryption Forward Trust Cert for an HA Pair via Panorama?

S.Cantwell — Mon, 09 Dec 2019 19:53:53 GMT

Hello there.

I would have presumed that your CN or Common Name is either IP or FQDN name (which both FW would synch between them)

So in your template, your inside IP for both FWs is the same.. ( right??? ) and the FDQN name (if you used this for your CN) is the same on both FWs.

I guess, I am trying to determine if you used a wildcard cert on ALL firewalls?

So no, it should not be a problem to push the cert to both FWs.

Are there any other details that would create a difference (SNs are not included in differences).

Also, what is your methodology to get the cert onto all end user browsers (IE, Edge, Chrome, Firefox, Safari, Opera, etc)

Please advise.

topic Re: Generating SSL Decryption Forward Trust Cert for an HA Pair via Panorama? in General Topics

Generating SSL Decryption Forward Trust Cert for an HA Pair via Panorama?

Re: Generating SSL Decryption Forward Trust Cert for an HA Pair via Panorama?