After Forward Trust certificate is renewed

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

After Forward Trust certificate is renewed

L1 Bithead

After Forward Trust certificate is renewed is there a way to validate the renewed certificate is working correctly from either GUI or CLI?
Device > Certificate Management > Certificates > Forward UNTrust Certificate

1 accepted solution

Accepted Solutions

@NetWright,

I guess if you don't trust what the CLI is telling you can the certificate as specified in your decryption rulebase entires you would need to perform a PCAP and verify that the client is actually getting the correct cert.

Really though as long as the above command is showing you what you need and the actual decryption entries reference the correct certificate I can't think of a reason why you would need to verify it further; but if for some reason you do, a simple PCAP on the client traffic would work perfectly fine. 

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

You're looking for the following command in the CLI

show system setting ssl-decrypt certificate

Thanks. 
Ok, yeah I see the cert with that command (  show system setting ssl-decrypt certificate ).
.  
Wondering if there's a way to validate when the cert is being used and that it's being used successfully.
I know the Untrusted cert will be presented only when the PAN doesn't trust the sites CA but how to see this?
I see the behavior from the client side using this site - https://untrusted-root.badssl.com/
Is there a way to see what cert is being presented for the client from the PAN side?

 

show system setting ssl-decrypt certificate

<<snip>>
global untrusted
ssl-decryption x509 certificate
version 2
cert algorithm 4
valid 200310033320Z -- 210310033320Z
cert pki 1
subject: SSL Decrypt Untrusted 2018
issuer: SSL Decrypt Untrusted 2018
serial number(4)
7b 89 e3 36 {..6
rsa key size 2048 bits siglen 256 bytes
basic constraints extension CA 1

@NetWright,

I guess if you don't trust what the CLI is telling you can the certificate as specified in your decryption rulebase entires you would need to perform a PCAP and verify that the client is actually getting the correct cert.

Really though as long as the above command is showing you what you need and the actual decryption entries reference the correct certificate I can't think of a reason why you would need to verify it further; but if for some reason you do, a simple PCAP on the client traffic would work perfectly fine. 

  • 1 accepted solution
  • 3817 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!