SSL decryption. What kind of the certificate l can use?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL decryption. What kind of the certificate l can use?

L3 Networker

Hi Guys,

 

Can you explain to me what types of the certificates l can use and where can l get them from?  For SSL decryption, we do not want to use the self-signed cert.

 

Thank you,

Mykhaylo

1 accepted solution

Accepted Solutions

L4 Transporter

Hello Mykhaylo,

 

You will need a root certificate/subordinate certifcate. Essentially you need a certificate that will be used to generate a new certificate based off the original certificate in the handshake, the certificate that is generated will then be signed by the certificate you choose for decryption.

 

It is highly unlikely you will get a certificate like this from a public authority, if you could get this kind of certificate then you could decrypt public traffic which would invalidate the use of public key infrastructure on the internet.

 

hope this helps,

Ben

View solution in original post

5 REPLIES 5

L4 Transporter

Hello Mykhaylo,

 

You will need a root certificate/subordinate certifcate. Essentially you need a certificate that will be used to generate a new certificate based off the original certificate in the handshake, the certificate that is generated will then be signed by the certificate you choose for decryption.

 

It is highly unlikely you will get a certificate like this from a public authority, if you could get this kind of certificate then you could decrypt public traffic which would invalidate the use of public key infrastructure on the internet.

 

hope this helps,

Ben

L5 Sessionator

Hi Mykhaylo,

 

We have to use a root CA certificate for decryption. We should have both root ca certificate public key and private key.

 

Why we need root ca is because whenever a client initiate a ssl handshake to a server firewall will intercept that request and then firewall will send a client hello from itself to server now server will reply for that client hello with server hello and it will also give a certificate. Firewall will take all field of the certificate sent from server and generate a similar certificate sign this new certificate with root CA  cert this newly signed certificate is forwarded to actual client.  Only a root CA certificate can generate/sign a certificate.

 

No CA server will give their root CA certificate private key to anyone. So we have to use a selfsigned root certificate.

 

Hope this helps!

Thanks guys


@Pankaj.kumar wrote:

Hi Mykhaylo,

 

We have to use a root CA certificate for decryption. We should have both root ca certificate public key and private key.

 

Why we need root ca is because whenever a client initiate a ssl handshake to a server firewall will intercept that request and then firewall will send a client hello from itself to server now server will reply for that client hello with server hello and it will also give a certificate. Firewall will take all field of the certificate sent from server and generate a similar certificate sign this new certificate with root CA  cert this newly signed certificate is forwarded to actual client.  Only a root CA certificate can generate/sign a certificate.

 

No CA server will give their root CA certificate private key to anyone. So we have to use a selfsigned root certificate.

 

Hope this helps!


 

You don't need to use a root CA certificate.  What I did was issue a subordinate CA certificate from our internal intermediate issuing CA and use that as the Forward Trust Certificate in PAN-OS.  This way, all of our clients already trust certificates issued by the PAN NGFW because they trust the root CA certificate at the base of the chain.  Additionally, if the private key for the Forward Trust Certificate was ever compromised, we could always revoke the certificate using our intermediate CA.

 

In my opinion, this is a much simpler and more secure method than making the PAN NGFW its own root CA.

Yes It can be a subordidnate CA cert. Main point is it should be a ca cert.

  • 1 accepted solution
  • 3289 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!