ACME and SSL decryption

[itassetbenilde]

So i recently got wind of this:

https://www.thesslstore.com/blog/47-day-ssl-certificate-validity-by-2029/

acme.sh and/or certbot takes care of the servers, but won't this break existing SSL decryption rules?

Any strategies/workarounds for this? tia

[OtakarKlier]

Hello,

Yes an expired certificate will give users with cert errors. If you have internal certificate servers for active directory, use that instead since all the machines will already trust it. You can generate a self signed certificate from the firewall and copy it to all the clients so they accept it.

Regards,

[itassetbenilde]

Does Palo Alto have an equivalent mechanism for updating certificates on the firewall, particularly for SSL inbound inspection? i can see how ACME can break SSL decryption at every renewal.

[kiwi]

Hi @itassetbenilde ,

While PAN-OS 11.0+ introduced ACME support for Let's Encrypt, extending automated ACME workflows for specific enterprise CAs is currently tracked under an existing Feature Request: Automatic PAN-OS ACME Trusted Certificate Renewal Support.

Please reach out to your local Palo Alto Networks Systems Engineer (SE) or Account Team and ask them to add your vote to this Feature Request.

Increasing the vote count helps our Product Management team prioritize this on the roadmap.

Your SE can also provide the most up-to-date roadmap details regarding this request!

Kind regards,