topic Re: Renew firewall CA certificate and distribute with GPO in General Topics

Renew firewall CA certificate and distribute with GPO

ZEBIT — Thu, 06 May 2021 06:48:24 GMT

We have created on the firewall a Root CA which also signs the SSL Forward Trust certificate.

The firewall Root CA certificate has been deployed with GPO to all our devices there Trusted Root Certificate Authorities.

The root ca certificate on the firewall will almost expire and needs to be renewed, but what is the procedure?

Select the certificate -> click renew -> commit, export this certificate and redistribute everything through GPO again?

Re: Renew firewall CA certificate and distribute with GPO

reaper — Thu, 06 May 2021 10:12:10 GMT

that pretty much describes the correct procedure, since it's a self-signed certificate

a CA that's part of your ActiveDirectory might be a good replacement going forward as that will be easier to maintain if you need to roll out updates etc

Re: Renew firewall CA certificate and distribute with GPO

ZEBIT — Thu, 06 May 2021 11:16:17 GMT

@reaper We did this before but the thing is we use this Windows CA to sign lot of internal applications.

If the firewall would get breached or hacked, the hacker is able to get the Windows CA certificate.

This way we need to re-generate the Windows CA and resign all these applications.