Certificate ca status from the CLI

Reply
Highlighted
L2 Linker

Certificate ca status from the CLI

I have successfully loaded my device certificate and a CA certificate from the CLI - took some seraching for format of the certificate strings, but they're in there now. 

One problem. 

In a firewall I have previously set up I show (in set format) the certificate stanza:

set shared certificate wanroot subject-hash ffffffff
set shared certificate wanroot issuer-hash ffffffff
set shared certificate wanroot not-valid-before "May 23 02:36:33 2020 GMT"
set shared certificate wanroot issuer /CN=wanroot
set shared certificate wanroot not-valid-after "May 18 02:36:33 2040 GMT"
set shared certificate wanroot common-name wanroot
set shared certificate wanroot expiry-epoch 2220921393
set shared certificate wanroot ca yes
set shared certificate wanroot subject /CN=wanroot
set shared certificate wanroot public-key "-----BEGIN CERTIFICATE-----[blahblahblah]-----END CERTIFICATE-----"
set shared certificate wanroot algorithm EC

 

I get an error entering the line "set shared certificate wanroot ca yes" - Invalid syntax.

 

What is the correct way to declare a certificate a CA certificate from the CLI?

 

--Matthew

Tags (2)

Accepted Solutions
Highlighted
L2 Linker

Thanks for the tip, but it turns out that my problem wasn't about syntax but method.

Pasting all of the parts of a certificate into the configuration and comitting doesn't actually "install" a certificate, or so I've learned.

Rather than pasting it in, TAC informs me that I must exit configuration mode and import the certificate as below:

scp import certificate source-ip <scp server IP> remote-port <scp server port> from <user>@<scp server>:<path><filename> format <pem|pkcs12> [passphrase <pass phrase>] certificate-name <name>

Whe the certificate is imported, that invalid syntax line magically materializes in the show output. 

View solution in original post


All Replies
Highlighted
Community Team Member

Hi @MatthewSabin ,

 

I was testing these commands in my lab but the following isn't a valid CLI syntax anymore (maybe it used to be in a previous PAN-OS) :

set shared certificate <name> ca yes

 

The one command that comes close is using certificate-profile but I'm guessing that's not what you're looking for ? :

set shared certificate-profile <name> CA

 

I wasn't able to find anything else through CLI

 

Maybe someone else has an idea ?

 

Cheers,

-Kiwi.

 
Highlighted
L2 Linker

Thanks for the tip, but it turns out that my problem wasn't about syntax but method.

Pasting all of the parts of a certificate into the configuration and comitting doesn't actually "install" a certificate, or so I've learned.

Rather than pasting it in, TAC informs me that I must exit configuration mode and import the certificate as below:

scp import certificate source-ip <scp server IP> remote-port <scp server port> from <user>@<scp server>:<path><filename> format <pem|pkcs12> [passphrase <pass phrase>] certificate-name <name>

Whe the certificate is imported, that invalid syntax line magically materializes in the show output. 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!