topic Decryption Certs in General Topics

Decryption Certs

Pasquale01 — Mon, 22 Mar 2021 14:20:31 GMT

Does anybody know if we support separate Decryption Certs in a multi VSYS environment? I have an MSP who wants to use different Certs from each of their customers.

Thanks

Re: Decryption Certs

nikoolayy1 — Mon, 22 Mar 2021 17:18:44 GMT

As I have not done that myself on a vsys . I can only tell that the vsys is a separate virtual firewall and when you import a CA cert into a VSYS you select where to import it and to which vsys, so this should mean that it uses different trust ca for different vSYS.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/certificate-management/obtain-certificates/import-a-certificate-and-private-key

Can someone who has done it to 100% confirm this?

Re: Decryption Certs

BPry — Tue, 23 Mar 2021 01:25:35 GMT

@Pasquale01,

@nikoolayy1 is correct. This is easily done and you can control which VSYS you want to import the certificate into, or if you want to import said certificate as a shared cert across the system.