After Forward Trust certificate is renewed

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L1 Bithead

After Forward Trust certificate is renewed

After Forward Trust certificate is renewed is there a way to validate the renewed certificate is working correctly from either GUI or CLI?
Device > Certificate Management > Certificates > Forward UNTrust Certificate


Accepted Solutions
Highlighted
Cyber Elite

@NetWright,

I guess if you don't trust what the CLI is telling you can the certificate as specified in your decryption rulebase entires you would need to perform a PCAP and verify that the client is actually getting the correct cert.

Really though as long as the above command is showing you what you need and the actual decryption entries reference the correct certificate I can't think of a reason why you would need to verify it further; but if for some reason you do, a simple PCAP on the client traffic would work perfectly fine. 

View solution in original post


All Replies
Highlighted
Cyber Elite

You're looking for the following command in the CLI

show system setting ssl-decrypt certificate
Highlighted
L1 Bithead

Thanks. 
Ok, yeah I see the cert with that command (  show system setting ssl-decrypt certificate ).
.  
Wondering if there's a way to validate when the cert is being used and that it's being used successfully.
I know the Untrusted cert will be presented only when the PAN doesn't trust the sites CA but how to see this?
I see the behavior from the client side using this site - https://untrusted-root.badssl.com/
Is there a way to see what cert is being presented for the client from the PAN side?

 

show system setting ssl-decrypt certificate

<<snip>>
global untrusted
ssl-decryption x509 certificate
version 2
cert algorithm 4
valid 200310033320Z -- 210310033320Z
cert pki 1
subject: SSL Decrypt Untrusted 2018
issuer: SSL Decrypt Untrusted 2018
serial number(4)
7b 89 e3 36 {..6
rsa key size 2048 bits siglen 256 bytes
basic constraints extension CA 1

Highlighted
Cyber Elite

@NetWright,

I guess if you don't trust what the CLI is telling you can the certificate as specified in your decryption rulebase entires you would need to perform a PCAP and verify that the client is actually getting the correct cert.

Really though as long as the above command is showing you what you need and the actual decryption entries reference the correct certificate I can't think of a reason why you would need to verify it further; but if for some reason you do, a simple PCAP on the client traffic would work perfectly fine. 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!