topic Certificate ca status from the CLI in General Topics

Certificate ca status from the CLI

MatthewSabin — Tue, 20 Oct 2020 04:27:07 GMT

I have successfully loaded my device certificate and a CA certificate from the CLI - took some seraching for format of the certificate strings, but they're in there now.

One problem.

In a firewall I have previously set up I show (in set format) the certificate stanza:

set shared certificate wanroot subject-hash ffffffff
set shared certificate wanroot issuer-hash ffffffff
set shared certificate wanroot not-valid-before "May 23 02:36:33 2020 GMT"
set shared certificate wanroot issuer /CN=wanroot
set shared certificate wanroot not-valid-after "May 18 02:36:33 2040 GMT"
set shared certificate wanroot common-name wanroot
set shared certificate wanroot expiry-epoch 2220921393
set shared certificate wanroot ca yes
set shared certificate wanroot subject /CN=wanroot
set shared certificate wanroot public-key "-----BEGIN CERTIFICATE-----[blahblahblah]-----END CERTIFICATE-----"
set shared certificate wanroot algorithm EC

I get an error entering the line "set shared certificate wanroot ca yes" - Invalid syntax.

What is the correct way to declare a certificate a CA certificate from the CLI?

--Matthew

Re: Certificate ca status from the CLI

kiwi — Thu, 22 Oct 2020 08:02:34 GMT

Hi @MatthewSabin ,

I was testing these commands in my lab but the following isn't a valid CLI syntax anymore (maybe it used to be in a previous PAN-OS) :

set shared certificate <name> ca yes

The one command that comes close is using certificate-profile but I'm guessing that's not what you're looking for ? :

set shared certificate-profile <name> CA

I wasn't able to find anything else through CLI

Maybe someone else has an idea ?

Cheers,

-Kiwi.

Re: Certificate ca status from the CLI

MatthewSabin — Tue, 03 Nov 2020 20:15:07 GMT

Thanks for the tip, but it turns out that my problem wasn't about syntax but method.

Pasting all of the parts of a certificate into the configuration and comitting doesn't actually "install" a certificate, or so I've learned.

Rather than pasting it in, TAC informs me that I must exit configuration mode and import the certificate as below:

scp import certificate source-ip <scp server IP> remote-port <scp server port> from <user>@<scp server>:<path><filename> format <pem|pkcs12> [passphrase <pass phrase>] certificate-name <name>

Whe the certificate is imported, that invalid syntax line magically materializes in the show output.