LetsEncrypt integration

[Brett_Hobbs]

Hi,

While I know most would use an issued SSL certificate it would be great if PANOS supported LetsEncrypt for requesting SSL certificates for things like the management interface and GlobalProtect.

[CHKlomp]

I'm interested in a private CA push to the PAN f/w's.

We're using Ansible, but have not found yet how to use the PAN module to import the new certificate...

Is there any link to the instructions how to do that?

[mrzepa2]

Greetings,

I would love to have native support for Lets Encrypt.

[Brett_Hobbs]

Now that chrome and safari are moving to 1 year certs this is becoming a must have.

I would suggest a slight change to the original idea I posted from LetsEncrypt integration to inclusion of the certbot agent. The reason is that many CA's are now supporting cert requests via Certbot  so this would allow users to use either LetsEncrypt or their own preferred CA.

[pete_b]

Is there any update from PAN on this? It would be super helpful.

Prefer the idea of certbot intergration but we use LE at the moment so would be as happy with that.

Cheers

[rhagen]

Just a few thoughts on this topic:

1.  For those that simply want to know the API calls for uploading certificates and keys to a firewall or Panorama.  This is supported and here are some examples:

curl -k -X POST 'https://firewall.someplace.org/api?key={{key}} &type=import&category=certificate&certificate-name=my_cert&format=pem' --form 'file=@cert.pem'

curl -k -X POST 'https://firewall.someplace.org/api?key={{key}}&type=import&category=private-key&certificate-name=my_cert&passphrase=%22{{passphrase-or-blank}}%22&format=pem' --form 'file=@privkey.pem'

Note that there was a permissions bug that was fixed in 9.0.8 and 9.1.0.  In prior releases these API calls required superuser permissions.  The fix allowed for any administrator with API import rights to perform these API calls. 

There is also a single API call that can upload the certificate and private key simultaneously.  However, that was somehow omitted from the fix in 9.0.8 and 9.1.0.

curl -k -XPOST 'https://firewall.someplace.org/api?key={{key}}&type=import&category=keypair&certificate-name=my_cert&passphrase=%22{{passphrase-or-blank}}%22&format=pem' --form 'file=@newcert.pem'

2.  It is highly unlikely that certbot would ever be integrated into PAN-OS.  Not only would this require running third-party software agents on the firewall management plane, but it would also require exposing the management plane to the Internet in order to support LE's issuance/renewal validation process.  That's probably fine for a web server, but not for a security platform.

I've been working with a number of large enterprise customers (particularly in the financial industry) and many of them have been leveraging a Palo Alto Networks technology partner called Venafi to perform certificate lifecycle management on PAN-OS.  It manages certificate discovery/uploads/renewals/revocations as well as authentication profiles, certificate profiles, and SSL decryption profiles.  Best of all they've PKI-neutral.  Their software is simply a broker for whichever PKI you happen to be using.

Check them out here: https://marketplace.venafi.com/details/palo-alto-networks-ngfw/

Hope this helps!

[panguyen]

Hi @CHKlomp, @pete_b 

You may want to check out this article on how to automate cert's with LetsEncrypt and PANOS

Costless, Automated, Trusted Certificates on Palo Alto Networks Firewalls 

[jemery]

We utilize Let's Encrypt to simply cert management for a number of our public web servers and security devices.  Certificate management is time consuming and very disjointed.  Freeing up administrators from managing this on a regular basis is good resource management.   PANOS supporting it natively like Barracuda, would make the most sense.

[LFura]

I also would like to see the ability to use Let's Encrypt certificates built directly in to the PANOS so you can set it up one time and have the firewall automatically handle the renewal etc without the need to use some other machine on the network and api calls etc.

[CLIq]

@panguyen great work on the write-up and script!

does your script import the complete certificate chain? if not by default, is there a way to do so? 🙂

by the way, the script has an issue when importing wildcard certificates, has something to do with the naming.

workaround is to create the certificate as e.g. mydomain.com and add a SAN for *.mydomain.com

one suggestion to the how to, would be cool to include a way without cloudflare (e.g. apache) and for both modes also mention which firewall rules need to be configured in which direction at a minimum (e.g. I used a custom url category to match the well-known acme-challenge URL for incoming traffic but only allowed the actual domain to be accessed from certain countries before i now also switched to dns_cf api)

[CLIq]

@panguyen hope you read this at some point, the certificate the script imports to the firewall seems to not import the fullchain? at least clients are reporting errors about not trusting the certificate because of missing intermediate certificates / chain. now this doesnt pose issues under windows or even chrome or firefox but for some applications that check certificates as well or e.g. macosx this causes invalid certificate chain trust issues.

am i doing something wrong or is the fullchain not imported?

[ArinGregoriades]

I hope you're still around.  We all still want to be able to support Let's Encrypt natively.  Currently I'm using a Linux box with a script to accomplish this.  

[jemery]

Agreed

[TyronF]

Would still love this functionality.

[Brett_Hobbs]

I get the point around certbot but PA could implement their own code that supports the ACME protocol for issuing certs.

Digicert now supports this directly to their API and others are adding it, I don't see that requiring a off-box solution is really needed. While I can see that it works and is a solution having the product take care of it's own security would be helpful especially to smaller deployments.

[btorresgil]

Forgive me if I'm missing something, but wouldn't supporting ACME protocol natively on the firewall require that the firewall management IP be accessible from the internet with a port open to validate the cert request? This seems like it would increase the attack surface. Please correct me if I'm wrong.