Doubt with Subordinate-CA Cert in PA firewall
Good evening, for issues related to for example decrypt as we need a certificate type CA, we can generate a certificate Subordinate-Ca from for example our CA server enterprise windows, import in our Palo Alto Firewall and as customers trust it, it would be transparent for issues such as the use of decrypt.
I have an additional doubt, and while I know that the role of the firewall is not to issue certificates, however, by having this Subordinate-CA in Palo Alto, that means that you can generate certificates, signed by the Subordinate-Ca in Palo Alto no? Example for ABC reason, the access to the Windows server CA is not available or someone will make the decision to do so, could new certificates be created and signed from Palo Alto signed by the Subordinate-Ca ? Example to create certificates that could potentially be used by the web-gui of the managmente device is this true or not ? I know this is not the best practice, in fact it is a lousy practice, based on the and services offered by each component of the infrastructure and network, but eventually it is something that could be done ? And in the same case, you should also upload the certificate of the main CA of the PKI Enterprise internal PKI to comply with the chain ? or with the Subordinate-Ca would be enough to generate new certificates potentially valid ?
Thanks for the collaboration, your time and the clarification of the doubts.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!