Cortex XDR Certificate enforcement for Windows and macOS endpoints

[Vinothkumar_SBA]

Hi Team,

I have a query regarding the Cortex XDR Agent (8.3) Certificate Enforcement settings.

1. Enable the Certificate Enforcement option.
2. Decrypt either only Cortex XDR Agent traffic in the firewall or decrypt all traffic related to application servers in the firewall.

Please confirm if these steps are correct, as I have not found comprehensive documentation on this configuration.

[jmazzeo]

Hi @Vinothkumar_SBA, thanks for reaching us using the Live Community.

The Agent Certificate Enforcement is a feature introduced in 8.3 to improve the agent security, by enforcing the use of root CA that is provided by Palo Alto Networks rather than on the local machine. You have more information in the Agents Settings Profile document.

If you have SSL Decryption in your firewall, the FQDNS are still needed to be added as an exception for the XDR Agents. Here you can find the resources to except.

If this post answers your question, please mark it as the solution.

[Vinothkumar_SBA]

Hi Jmazzeo,

Thank you for your response. You mentioned that only the Cortex XDR agent URLs should be added to the FQDN exception list, and not all URLs or other application server URLs. Is my understanding correct or incorrect?

[jmazzeo · Accepted solution]

Hi, I linked this document that shows all the required URLs: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Resourc...

Not only the tenant URL, there are a few more that the agent needs to communicate. If you have PANW NGFW you can see the App-ID Coverage in that doc.