intermediate certificates

[smledv]

Hello everyone,

Is there a solution other than manually importing intermediate certificates into the Palo Alto Firewall (PAN-OS10.2.9-h1)?

Since there are weekly a few websites with this problem popping up.

I already know the import procedure that is described in the knowledge base.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm66CAC

for example:

www.deepl.com

https://www.i-doit.com/

www.fabrilscavone.com.br

(Deepl.com on Second DNS IP)

Thanks in advance

[aleksandar.astardzhiev]

Hi @smledv ,

As described here - Repair Incomplete Certificate Chains (paloaltonetworks.com) the RFC standard requires the server to send the full chain of trust. Unfortunately it is very common to not follow the RFC, which prevent the firewall to verify the root CA.

So in one perfect world we should expect server administrators to fix their servers instead of importing intermediate certificates to the network devices/firewalls.

I know the reality is far for that...Unfortunately I am not aware of any automated solution that could solve this.

If you are not afraid to get your hands dirty with scripting, you may be able to achieve something with the steps described in the above link and some XML API calls to the firewall.

The problem I am having with such automated approach is the lack of review from the administrator. I would personally prefer person to review the blocked page and verify if the intermediate certificate needs to be imported, or user is trying to access something that is potentially dangerous.