Active Passive and Active Active PA and Web Gui Cert

[MP18]

I have created CSR and exported that to our Server team as they would generate the cert based off of that.

PA is in active passive mode.

Do webgui cert of Active PA will syn with Passive PA?

Do I need to create separte CSR for the passive PA?

We also have PA in Active Active mode.

Does A/P Webgui Cert process is same as Active Active PA?

[OtakarKlier]

Hello,

Yes you will need a new csr and cert as certificates are not shared during a commit or config sync.

Regards,

[Raido_Rattameister]

Certificates are shared in HA config and also webgui cert config (Device > Setup > Management > Authentication Settings).

So unless you use wildcard you will still get error when you log into one of them as both webgui's have their own DNS name.

Most likely SAN cert that has DNS name of both webgui's on it will work aswell but I have not tested it.

[MP18]

Can you please explain about this in more 

So unless you use wildcard you will still get error when you log into one of them as both webgui's have their own DNS name.

Currently on active PA i used the common name as host name of the PA

[Raido_Rattameister · Accepted solution]

Well it does not matter that your firewalls are set into HA.

They both still have their own management IP (unless you manage it through network interface).

Let's assume that:

PA1 mgmt IP is 10.0.0.11

PA1 mgmt interface DNS name PA1.corp.local that resolves to 10.0.0.11

PA2 mgmt IP is 10.0.0.12

PA2 mgmt interface DNS name PA2.corp.local that resolves to 10.0.0.12

Then you either need *.corp.local cert or SAN cert that has both PA1.corp.local and PA2.corp.local on it.

Management interface cert config is shared between firewalls.

[MP18]

Yes i am using Web Gui cert for the Management interface of both firewalls.

So what I can do now is use this common name on both firewalls while generating the CSR ?

for example

*.NGFW

Then I do not need to create separate CSR for passive device right?

[Raido_Rattameister · Accepted solution]

You can't use seperate for passive firewall.

This part of the config is synced it means that same cert is used for both active and passive.

Wildcard is probably best way to go.

[MP18]

Many Thanks Raido will give it a  try.