LetsEncrypt integration

Reply
L1 Bithead

I'm interested in a private CA push to the PAN f/w's.

We're using Ansible, but have not found yet how to use the PAN module to import the new certificate...

Is there any link to the instructions how to do that?

 

L2 Linker

Greetings,

 

I would love to have native support for Lets Encrypt.

L1 Bithead

Now that chrome and safari are moving to 1 year certs this is becoming a must have.

 

I would suggest a slight change to the original idea I posted from LetsEncrypt integration to inclusion of the certbot agent. The reason is that many CA's are now supporting cert requests via Certbot  so this would allow users to use either LetsEncrypt or their own preferred CA.

L0 Member

Is there any update from PAN on this? It would be super helpful.

 

Prefer the idea of certbot intergration but we use LE at the moment so would be as happy with that.

Cheers

L3 Networker

Just a few thoughts on this topic:

 

1.  For those that simply want to know the API calls for uploading certificates and keys to a firewall or Panorama.  This is supported and here are some examples:

curl -k -X POST 'https://firewall.someplace.org/api?key={{key}} &type=import&category=certificate&certificate-name=my_cert&format=pem' --form 'file=@cert.pem'

curl -k -X POST 'https://firewall.someplace.org/api?key={{key}}&type=import&category=private-key&certificate-name=my_cert&passphrase=%22{{passphrase-or-blank}}%22&format=pem' --form 'file=@privkey.pem'

 

Note that there was a permissions bug that was fixed in 9.0.8 and 9.1.0.  In prior releases these API calls required superuser permissions.  The fix allowed for any administrator with API import rights to perform these API calls. 

 

There is also a single API call that can upload the certificate and private key simultaneously.  However, that was somehow omitted from the fix in 9.0.8 and 9.1.0.

curl -k -XPOST 'https://firewall.someplace.org/api?key={{key}}&type=import&category=keypair&certificate-name=my_cert&passphrase=%22{{passphrase-or-blank}}%22&format=pem' --form 'file=@newcert.pem'

 

2.  It is highly unlikely that certbot would ever be integrated into PAN-OS.  Not only would this require running third-party software agents on the firewall management plane, but it would also require exposing the management plane to the Internet in order to support LE's issuance/renewal validation process.  That's probably fine for a web server, but not for a security platform.

 

I've been working with a number of large enterprise customers (particularly in the financial industry) and many of them have been leveraging a Palo Alto Networks technology partner called Venafi to perform certificate lifecycle management on PAN-OS.  It manages certificate discovery/uploads/renewals/revocations as well as authentication profiles, certificate profiles, and SSL decryption profiles.  Best of all they've PKI-neutral.  Their software is simply a broker for whichever PKI you happen to be using.

 

Check them out here: https://marketplace.venafi.com/details/palo-alto-networks-ngfw/

 

Hope this helps!

L2 Linker

Hi @CHKlomp@pete_b 

 

You may want to check out this article on how to automate cert's with LetsEncrypt and PANOS

 

Costless, Automated, Trusted Certificates on Palo Alto Networks Firewalls 

L0 Member

We utilize Let's Encrypt to simply cert management for a number of our public web servers and security devices.  Certificate management is time consuming and very disjointed.  Freeing up administrators from managing this on a regular basis is good resource management.   PANOS supporting it natively like Barracuda, would make the most sense.

L0 Member

I also would like to see the ability to use Let's Encrypt certificates built directly in to the PANOS so you can set it up one time and have the firewall automatically handle the renewal etc without the need to use some other machine on the network and api calls etc.

L2 Linker

@panguyen great work on the write-up and script!

does your script import the complete certificate chain? if not by default, is there a way to do so?

 

by the way, the script has an issue when importing wildcard certificates, has something to do with the naming.

workaround is to create the certificate as e.g. mydomain.com and add a SAN for *.mydomain.com

 

one suggestion to the how to, would be cool to include a way without cloudflare (e.g. apache) and for both modes also mention which firewall rules need to be configured in which direction at a minimum (e.g. I used a custom url category to match the well-known acme-challenge URL for incoming traffic but only allowed the actual domain to be accessed from certain countries before i now also switched to dns_cf api)

L2 Linker

@panguyen hope you read this at some point, the certificate the script imports to the firewall seems to not import the fullchain? at least clients are reporting errors about not trusting the certificate because of missing intermediate certificates / chain. now this doesnt pose issues under windows or even chrome or firefox but for some applications that check certificates as well or e.g. macosx this causes invalid certificate chain trust issues.

 

am i doing something wrong or is the fullchain not imported?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!