topic Re: After Forward Trust certificate is renewed in General Topics

After Forward Trust certificate is renewed

NetWright — Tue, 10 Mar 2020 01:01:40 GMT

After Forward Trust certificate is renewed is there a way to validate the renewed certificate is working correctly from either GUI or CLI?
Device > Certificate Management > Certificates > Forward UNTrust Certificate

Re: After Forward Trust certificate is renewed

BPry — Tue, 10 Mar 2020 02:17:46 GMT

You're looking for the following command in the CLI

show system setting ssl-decrypt certificate

Re: After Forward Trust certificate is renewed

NetWright — Tue, 10 Mar 2020 03:54:21 GMT

Thanks.
Ok, yeah I see the cert with that command ( show system setting ssl-decrypt certificate ).
.
Wondering if there's a way to validate when the cert is being used and that it's being used successfully.
I know the Untrusted cert will be presented only when the PAN doesn't trust the sites CA but how to see this?
I see the behavior from the client side using this site - https://untrusted-root.badssl.com/
Is there a way to see what cert is being presented for the client from the PAN side?

show system setting ssl-decrypt certificate

<<snip>>
global untrusted
ssl-decryption x509 certificate
version 2
cert algorithm 4
valid 200310033320Z -- 210310033320Z
cert pki 1
subject: SSL Decrypt Untrusted 2018
issuer: SSL Decrypt Untrusted 2018
serial number(4)
7b 89 e3 36 {..6
rsa key size 2048 bits siglen 256 bytes
basic constraints extension CA 1

Re: After Forward Trust certificate is renewed

BPry — Tue, 10 Mar 2020 21:04:41 GMT

@NetWright,

I guess if you don't trust what the CLI is telling you can the certificate as specified in your decryption rulebase entires you would need to perform a PCAP and verify that the client is actually getting the correct cert.

Really though as long as the above command is showing you what you need and the actual decryption entries reference the correct certificate I can't think of a reason why you would need to verify it further; but if for some reason you do, a simple PCAP on the client traffic would work perfectly fine.