topic Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES in General Topics

The SSL Certificate is showing unsecure in one device

Mohammed_Yasin — Sun, 05 Jul 2020 06:18:06 GMT

I have installed an SSL certificate on my firewall it is working fine for all of our Palo Alto devices except one device as it is showing it is not secure.

I checked and I found that the device is still using the localhost generated certificate. I don’t know how to force it to use the SSL Certificate I installed.

Note that I set up the SSL/TLS Service Profile and chosen the proper certificate from the list of Certificates. Which is the only certificate available?

Re: The SSL Certificate is showing unsecure in one device

OtakarKlier — Mon, 06 Jul 2020 20:50:30 GMT

Hello,

I would say follow the proper setup steps, you could have missed a step.

Regards,

Re: The SSL Certificate is showing unsecure in one device

Retired Member — Tue, 07 Jul 2020 15:02:26 GMT

Hi @Mohammed_Yasin,

Verify that Commit was successful on the device in question. If it was - reboot and recheck.

Open Support Case if issue persists.

Remember that WebUI certificates are not synchronized in a HA pair.

Re: The SSL Certificate is showing unsecure in one device

Mohammed_Yasin — Sun, 12 Jul 2020 07:20:38 GMT

I have reinstalled a certificate that was working fine with my firewall, but suddenly I lost access to the GUI of the firewall.

I tried what is mentioned here in the link below with no luck.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC

Re: The SSL Certificate is showing unsecure in one device

Retired Member — Mon, 13 Jul 2020 09:17:44 GMT

Hi @Mohammed_Yasin,

At this point I will suggesting getting in touch with TAC.

WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

Jal_963 — Mon, 20 Jul 2020 17:51:50 GMT

Dear ,

I need to install webui certificate for both the palo alto , CSR will be signed by internal CA.

Do i need to create CSR from each firewall ? like i can generate from Primary firewall or from both ?

Should i incude FQDN of each firewall as the common name while generate CSR ?

I can see the certificate are synchronising each other, but TLS profile not ?

Please assist me @OtakarKlier @Retired Member

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

OtakarKlier — Mon, 20 Jul 2020 18:16:13 GMT

Just the one should do. Dont need the firewall names since the certificate is just being used between the PAN and the client.

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

Jal_963 — Mon, 20 Jul 2020 18:20:33 GMT

@OtakarKlier thanks for the quick reply.

so What should i include in Common name while generating CSR ?

Once i uploaded the signed certificate and root CA to the firewall , I need to create ssl/tls profile in both the Palo alto firewall right ?

Then i will add this profile in general setting in both the firewall ?

Correct me if am wrong ?

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

OtakarKlier — Mon, 20 Jul 2020 18:27:40 GMT

Just the name of the certificate. Its either going to be a self signed CA or a subordinate CA cert.

Ensuring the Proper Certificate Authority on the Firewall and Exporting the CA to Clients

Loading or generating a CA certificate on the Palo Alto Networks firewall is needed, because a Certificate Authority (CA) is required to decrypt traffic properly by generating SSL certificates on the fly. Either create a self-signed CA on the firewall or import a subordinate CA from your own PKI infrastructure. Select Forward Trust Certificate and Forward Untrust Certificate on one or more certificates to enable the firewall to decrypt traffic. Because SSL Certificate providers like Entrust, Verisign, Digicert, and GoDaddy do not sell CAs, they are not supported in SSL Decryption.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgHCAS

Cheers!

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

Jal_963 — Mon, 20 Jul 2020 18:35:07 GMT

@OtakarKlier thanks for the response .

I am asking for the WebUI certificate , which will be signed by our internal CA (Microsoft CA )

we are not using the public signed certificate.

For Webui, one Certificate is enough for both Palo alto ?

certificate is synronising between the Active/Passive HA , however SSL/Tls profile not ?

i need to create seperate SSL/TLS profile for both the PA ?

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

OtakarKlier — Mon, 20 Jul 2020 18:37:16 GMT

Sorry, my bad. You will need one cert per device.

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

Jal_963 — Mon, 20 Jul 2020 18:46:48 GMT

@OtakarKlier yea , but while generating CSR what should i added in Common name ?

should i generate CSR from both the Firewall or i can generate two CSR from Primary Firwewall added different Common name ?

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

OtakarKlier — Mon, 20 Jul 2020 18:47:55 GMT

csr for each...

Re: WEBUI_CERTIFICATE FOR THE PALO ALTO HA DEVICES

Retired Member — Tue, 21 Jul 2020 08:33:24 GMT

@Jal_963,

In principle:

you can generate CSRs from the Active Node in HA, Passive Node in HA, or from both - does not matter because they are synced, just have to time and queue the Commits right;
you can generate CSRs using external tool, I like working with XCA (https://hohnstaedt.de/xca/), and import them into PA after signing;
you can specify Common Name and Subject Alternative Name to whatever you want, however using the hostname/FQDN makes most sense most of the time as those correspond to the WebUI URL; best practice is to have both Common Name and Subject Alternative Name with equal values;
you possibly could use one certificate for WebUI of both HA nodes, however it would require some trickery;
Certificates and SSL/TLS Service Profiles are synced in HA as long as they are not used for WebUI.

More to the point, workflow could be:

Login into Active Node;
prepare two CSRs with CN/SAN corresponding to the WebUI URLs on Active Node;
import signed by external CA certificates into Active Node;
Commit on Active Node;
create two SSL/TLS Service Profiles, one for each certificate;
use one of the SSL/TLS Service Profiles as WebUI SSL/TLS Service Profile on Active Node;
Commit on Active Node;
Login into Passive Node;
use one of the SSL/TLS Service Profiles as WebUI SSL/TLS Service Profile on Passive Node;
Commit on Passive Node;

It is possible to perform it a bit quicker, but longer way is simpler.