topic on Palo Alto Certificate create in General Topics

on Palo Alto Certificate create

kuveytturk — Wed, 29 Feb 2012 07:49:09 GMT

We create a certificate on our local CA. We want to decrypt traffic in Palo Alto using this certificate. We decided to use the CN as "*" to match all destination hostnames the client will use. We installed the certificate and the intermediate and root certificates on Palo Alto but we could not be able to decrypt the traffic via this certificate. Could you help us to decrypt the traffic and to understand whether it is successfull or not?

Re: on Palo Alto Certificate create

mikand — Wed, 29 Feb 2012 09:29:15 GMT

You create a new CA to be used for this purpose.

The CA public and private cert is then imported to the PAN so it can create the MITM certs on the fly to perform the SSL-termination/inspection.

The CA public cert is then imported to the client as a trusted issuer.

The CN used for the CA is the line your browser will display when you click on the lock (in the browser) and it says "This site has been verified by XXX".