LetsEncrypt integration

Reply
Highlighted
L1 Bithead

I'm interested in a private CA push to the PAN f/w's.

We're using Ansible, but have not found yet how to use the PAN module to import the new certificate...

Is there any link to the instructions how to do that?

 

Highlighted
L2 Linker

Greetings,

 

I would love to have native support for Lets Encrypt.

Highlighted
L1 Bithead

Now that chrome and safari are moving to 1 year certs this is becoming a must have.

 

I would suggest a slight change to the original idea I posted from LetsEncrypt integration to inclusion of the certbot agent. The reason is that many CA's are now supporting cert requests via Certbot  so this would allow users to use either LetsEncrypt or their own preferred CA.

Highlighted
L0 Member

Is there any update from PAN on this? It would be super helpful.

 

Prefer the idea of certbot intergration but we use LE at the moment so would be as happy with that.

Cheers

Highlighted
L3 Networker

Just a few thoughts on this topic:

 

1.  For those that simply want to know the API calls for uploading certificates and keys to a firewall or Panorama.  This is supported and here are some examples:

curl -k -X POST 'https://firewall.someplace.org/api?key={{key}} &type=import&category=certificate&certificate-name=my_cert&format=pem' --form 'file=@cert.pem'

curl -k -X POST 'https://firewall.someplace.org/api?key={{key}}&type=import&category=private-key&certificate-name=my_cert&passphrase=%22{{passphrase-or-blank}}%22&format=pem' --form 'file=@privkey.pem'

 

Note that there was a permissions bug that was fixed in 9.0.8 and 9.1.0.  In prior releases these API calls required superuser permissions.  The fix allowed for any administrator with API import rights to perform these API calls. 

 

There is also a single API call that can upload the certificate and private key simultaneously.  However, that was somehow omitted from the fix in 9.0.8 and 9.1.0.

curl -k -XPOST 'https://firewall.someplace.org/api?key={{key}}&type=import&category=keypair&certificate-name=my_cert&passphrase=%22{{passphrase-or-blank}}%22&format=pem' --form 'file=@newcert.pem'

 

2.  It is highly unlikely that certbot would ever be integrated into PAN-OS.  Not only would this require running third-party software agents on the firewall management plane, but it would also require exposing the management plane to the Internet in order to support LE's issuance/renewal validation process.  That's probably fine for a web server, but not for a security platform.

 

I've been working with a number of large enterprise customers (particularly in the financial industry) and many of them have been leveraging a Palo Alto Networks technology partner called Venafi to perform certificate lifecycle management on PAN-OS.  It manages certificate discovery/uploads/renewals/revocations as well as authentication profiles, certificate profiles, and SSL decryption profiles.  Best of all they've PKI-neutral.  Their software is simply a broker for whichever PKI you happen to be using.

 

Check them out here: https://marketplace.venafi.com/details/palo-alto-networks-ngfw/

 

Hope this helps!

Highlighted
L2 Linker

Hi @CHKlomp@pete_b 

 

You may want to check out this article on how to automate cert's with LetsEncrypt and PANOS

 

Costless, Automated, Trusted Certificates on Palo Alto Networks Firewalls 

Highlighted
L0 Member

We utilize Let's Encrypt to simply cert management for a number of our public web servers and security devices.  Certificate management is time consuming and very disjointed.  Freeing up administrators from managing this on a regular basis is good resource management.   PANOS supporting it natively like Barracuda, would make the most sense.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!