Deploying SSL decryption with Public CA

[john.langford@aplp.net]

I am trying to figure out how to deploy SSL decryption. I have it working in a test environment using an in house CA and by importing the cert. into my browser. As we have Firefox users and can't export the Trusted Root CA with a GPO, I am looking for an alternative. As a CA beginner, I am struggling with some of the concepts.

If a buy a cert for a known CA (godaddy - as I like Danica Patrick), can I use that cert on my PA and will the browser trust it? I have PAs at 5 locations (some HA pairs). Do I have to buy 5 certs (or more) or can I share the same cert?

Any advise would be great.

[kbrazil]

Hi John,

It is not possible to purchase the correct Certificate Authority cert from a trusted public source since only Server certs are sold.  Also, if this were allowed, it would invalidate the trust ecosystem that Certificates are based on, since then it would be possible to do trusted man-in-the-middle attacks out in the wild.

The Palo Alto Networks SSL decryption solution works best when the CA cert is generated from an internal CA that is already trusted in the company or that can be pushed out to the user's browser via global policy.

Cheers,

Kelly

[migration]

Hi John,

If you use (and you should use) a Trust (internal) CA certificate you need only one cert, the CA cert and you have to import it in every PAN device you have.

Otherwise yuou can generate a Self Signed Certificate or a server certificate issued by your internal CA for every PAN devices you have.

You dont' have to use and import a Trust Root CA in your web browser but a Subordinate CA.

First of all, I suggest you tu have a look some PKI documentation. Undestanding PKI is very important to use effectively PAN SSL-D

[KGC]

Are you having a problem with Firefox specifically? I was able to get SSL decryption working using our internal CA and IE browsers on the domain, but Firefox does not seem to pick up the CAs in the Windows store, which caused some issues. Not sure if there is a solution to this.

[john.langford@aplp.net]

Firefox is the main problem. IE is not really am problem - I can use a GPO for the certs. Chrome uses the same certs as IE, s that works. But our friend Firefox does not seem to have an enterprise solution to management it (for certs or other configs - we had a similar issue when deploying proxy settings).