Certificate chaining with Captive Portal

[ldormond]

Hello,

We have a PA-3020 running PanOS 5.0.0 in L3 deployment. We have just one Private zone and one Public zone for the instance.

I have configured a Captive Portal policy on the Private zone gto ensure that all users that are not authenticated by User-ID (users who are not logged in the domain) have to authenticate beffore accessing resources. I have set a Captive Portal redirect policy web-form based, linked with LDAP settings.

It works fine, users are redirected to the web-form and they can login if they have a login/password.

Then we have tried to import a certificate on the PaloAlto device in order to avoid the warning message in the browser. We have tried to add the CA root certificate as well as the intermediate certificate. From the PaloALto menu, the chaining seems correct (see certificate_chain.jpg) but the warning is still there in the browser. When we look at the certificate sent by the PaloAlto to the browser, we can see that the chaining is not effective.

However, it works fine for the management access : the certificate chain is effective and the certificate is well trusted by the browser. Also it seems that it is only related to the Captive Portal feature.

You can also see the Captive Portal settings (captive_portal.jpg).

Kind Regards,

[nbilly]

It seems that 'Globalsign Organization Validation CA' is not present in windows Trusted Root certificate store.

Ulli and Greg's replies are both valid solutions.

-Nicolas

[panwmod]

Greg's solution is actually the better on, it doesn't involve 'touching' all clients. Having the 'server' present his own and the intermediate CA allows the 'client' to confirm the authenticity of the server certificate with only having the root in his store.

Using openssl you can easily confirm that your imported cert on the PAN the it is working correctly

openssl s_client -CAfile <full path to root cert> -quiet -showcerts -connect <ip or fqdn of PAN>:6082

Thanks

Ulli

[ldormond]

Hi guys,

Thanks for your help and advices but it still doesn't work.

I followed this guide and created a joint PEM with the two certs.

I could import this but I am not sure I understand the next part. Before importing that do I need to make a CSR that matches that cert so that I can import it and have the private key.

If I import without a private key then I obviously can’t use it to sign the captive portal.

I also have a PFX bundle, that contains all of the certs and also the private key – importing that works and I can assigned it to the management web interface and the captive portal.

As before the management web interface show no errors and works correctly but the captive portal doesn’t seem to present the intermediate certificate.

Regards,

[gwesson]

Since you have the PFX, you can use openSSL to convert the PFX into separate files. Get the private key from that, then you can import the private key and the joint PEM file you created (no need for the CSR then).

[Colgonics]

What you do is merge the certificate and the CA into one cert and upload.  Palo Alto will not join the chain together for you.  You need to join the certificates yourself then upload.  The Panorama will strip the second certificate, so you will need to upload locally.  Took a bit of time but again, works nicely.  So do something like....

cat mycert.crt myCA.crt > mycertchain.pem.  Then upload that with the key.  This works.