topic Re: SSL Decryption - Intermediate Cert renewal in General Topics

SSL Decryption - Intermediate Cert renewal

brandonbushong — Thu, 20 Feb 2020 18:22:33 GMT

Hello, we are implementing Inbound SSL Decryption. The plan is to import the keys from our F5 Load Balancer. After a number of attempts and working with support, we found the only way for the import to work successfully is to import the bundle (CA / Intermediate / Certificate for the VIP).

While that process works, it leaves us with the question of renewal.

Our Intermediate certificate expires in May. Can we simply a) renew this certificate, b) can we just import this renewed certificate from the F5, or c) will we have to import the bundle again for all 20+ VIPs when this cert is renewed in May?

Re: SSL Decryption - Intermediate Cert renewal

BPry — Fri, 21 Feb 2020 02:25:11 GMT

@brandonbushong,

When you are talking about importing the bundle, do you mean that you simply had to import all three certificates or that you needed to chain all certificates? If you simply had to import all three certificates, you would simply import the new intermediate certificate so that the firewall trusts the full chain. If this is a chained certificate, you would need to update the chain and import the chained certificate.

Re: SSL Decryption - Intermediate Cert renewal

SutareMayur — Fri, 21 Feb 2020 05:22:34 GMT

@brandonbushong do you have same Client SSL profile on all 20 VIPs?

Because if certificate is renewed, you need to upload renewed certificate. If you have same Client ssl profile on all 20VIPs, you can simply replace expired certificate with new one and post updating it, it will get applied on all 20VIPs.

hope it helps!

Mayur

Re: SSL Decryption - Intermediate Cert renewal

brandonbushong — Fri, 21 Feb 2020 16:13:05 GMT

Thanks. Have you completed this in Production? I'd like to see or hear from someone who completed this and confirm the process works.

Re: SSL Decryption - Intermediate Cert renewal

SutareMayur — Fri, 21 Feb 2020 16:40:36 GMT

@brandonbushong I have done it on my LB. Let me know if you need any help.

Mayur

Re: SSL Decryption - Intermediate Cert renewal

brandonbushong — Fri, 21 Feb 2020 18:35:33 GMT

So you have completed this on the Palo and the F5?

Re: SSL Decryption - Intermediate Cert renewal

SutareMayur — Sat, 22 Feb 2020 03:06:07 GMT

Yes i have done it on F5. You need to do configurations on F5 and Web server end too. No need to do anything on Paloalto.

Please refer below article.

https://support.f5.com/csp/article/K4816

hope it helps!

Mayur