LetsEncrypt integration

[Brett_Hobbs]

Hi,

While I know most would use an issued SSL certificate it would be great if PANOS supported LetsEncrypt for requesting SSL certificates for things like the management interface and GlobalProtect.

[gfreeman]

Hi Brett_Hobbs,

What would you be looking for in a Let's Encrypt integration from the workflow perspective?

If you still had to do the certbot renew from some linux box you controlled, then updating the certs on PAN-OS was provided as an Ansible or Terraform module, would that be helpful?

[Brett_Hobbs]

Hi,

That particular process would not work for us today (possibly in the future).

I was thinking that because GlobalProtect would have a DNS A record that having the certbot agent installed on the firewall we could support automatic verification and renewals.

MGMT interface woud take some aditional thought to solve either via your below method or some external DNS requirements.

[gfreeman]

For everyone that's interested in Let's Encrypt integration with PAN-OS:

Hi, my name is Garfield and I work here at Palo Alto Networks in the developer relations team.  I'm wanting to get a feel for the interest and expectations of a Let's Encrypt integration.  I'd very much appreciate anyone who's interested in a Let's Encrypt integration to respond to this thread with some information about their setup and expectations.

I'd like to separate this discussion into a few parts:  what integrations today are doing, what can be done to help that in the short term, and what the expectation for the end result could look like.

Today:  given that there is currently no native Let's Encrypt client on PAN-OS, people that are using Let's Encrypt certs on PAN-OS today are, to my knowledge, running a client on some (linux) host to renew the certs, then uploading the certs to their PAN-OS.

End-goal:  I assume that the desired end-result is that PAN-OS runs Let's Encrypt natively, doing cert renewal automatically behind the scenes.

So here's the questions I have:

1) If you're currently using Let's Encrypt certs with PAN-OS and your workflow does not look like the above, can you briefly describe it?

2) Is your desired end goal that PAN-OS runs Let's Encrypt natively?  If not, what is your desired end goal?

3) In between the end goal and now, would you want a stop-gap solution?

4) If you want a stop-gap solution, what form should it take?  A standalone executable / script?  Ansible module?  Terraform resource?  Tie-in to an existing Let's Encrypt client, such as certbot or acme.sh?

Thanks in advance for the feedback!

[AK-X]

1) If you're currently using Let's Encrypt certs with PAN-OS and your workflow does not look like the above, can you briefly describe it?

2) Is your desired end goal that PAN-OS runs Let's Encrypt natively?  If not, what is your desired end goal?

3) In between the end goal and now, would you want a stop-gap solution?

4) If you want a stop-gap solution, what form should it take?  A standalone executable / script?  Ansible module?  Terraform resource?  Tie-in to an existing Let's Encrypt client, such as certbot or acme.sh?

1. We don't use Lets Encrypt certs with PAN-OS currently because it's a pita to manage cert renewal manually as you have to do it every 90 days. We do run certbot on our other web servers, it runs everyday and renew only when cert is near expiring, it also swap out certs and flush apache cache automatically. If there is any error, an email is sent to me.

2. Natively or not, I think making the process automatic and simple is what I would expect.

3. and 4. Yes. it doesn't really matter as long as it can automate the process, or at least automate as much as possible, so that functions in PAN-OS don't fail just because admin forgot to renew the certs.

Other comment:

Please also make domain ownership validation options flexible as everyone's setup is different.

In our case, xyz.com as well as DNS is controlled by headquarter, branchvpn.abc.com and branchvpn2.abc.com are issued to us.  We won't be able to prove ownership of xyz.com but branchvpn.abc.com or branchvpn2.abc.com. And we can only use .well-known files method, and not DNS TXT method as we do not control DNS server.