topic Re: how to add PA forward decryption certificate to Minemeld in General Topics

how to add PA forward decryption certificate to Minemeld

idelconsulting — Sun, 25 Mar 2018 00:55:09 GMT

Dear all,

first of all, thanks a lot to all contributors for this great project.

Quick question: I configured my Minemeld instance in my local network and I also have SSL interception configured on my PA.

For the moment I had to exclude the IP of the Minemeld instance from SSL interception because of error messages. I assume that's because Minemeld doesn't trust my forward decryption certificate.

How can I add that to Minemeld?

Regards,

Andreas

Re: how to add PA forward decryption certificate to Minemeld

xhoms — Mon, 26 Mar 2018 15:34:26 GMT

Hi @idelconsulting,

you need to import the corresponding CA cert and update the cert bundle for MineMeld to trust certs issued by the SSL Decryption function.

Details in https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Certificate-Error-on-Miner-Refresh/m-p/168271#M1308

Re: how to add PA forward decryption certificate to Minemeld

idelconsulting — Mon, 26 Mar 2018 21:13:05 GMT

Hi @xhoms

thanks a lot. But so far that didn't work.

I'll ask a question on that other discussion you mentioned.

Regards,

Andreas

Re: how to add PA forward decryption certificate to Minemeld

idelconsulting — Tue, 27 Mar 2018 19:03:30 GMT

I added a comment to that other discussion.

The instructions required a couple of minor changes:

I exported my root CA certificate and the forward trust CA certifiacte from the PA.

Exported CA PEM files needs to be in:

/opt/minemeld/local/certs/site

with the extension .crt

Then, run

sudo -u minemeld mm-cabundle-update

Last step is restarting the engine from the System menu.

Now for me everything is working fine.

Regards,

Andreas