Doubt with Subordinate-CA Cert in PA firewall

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Doubt with Subordinate-CA Cert in PA firewall

L4 Transporter

Doubt with Subordinate-CA Cert in PA firewall


Good evening, for issues related to for example decrypt as we need a certificate type CA, we can generate a certificate Subordinate-Ca from for example our CA server enterprise windows, import in our Palo Alto Firewall and as customers trust it, it would be transparent for issues such as the use of decrypt.


I have an additional doubt, and while I know that the role of the firewall is not to issue certificates, however, by having this Subordinate-CA in Palo Alto, that means that you can generate certificates, signed by the Subordinate-Ca in Palo Alto no? Example for ABC reason, the access to the Windows server CA is not available or someone will make the decision to do so, could new certificates be created and signed from Palo Alto signed by the Subordinate-Ca ? Example to create certificates that could potentially be used by the web-gui of the managmente device is this true or not ? I know this is not the best practice, in fact it is a lousy practice, based on the and services offered by each component of the infrastructure and network, but eventually it is something that could be done ? And in the same case, you should also upload the certificate of the main CA of the PKI Enterprise internal PKI to comply with the chain ? or with the Subordinate-Ca would be enough to generate new certificates potentially valid ?


Thanks for the collaboration, your time and the clarification of the doubts.


Best regards.

High Sticker

Cyber Elite
Cyber Elite

The internal clients would trust the server certs, external clients won't have the appropriate chain of trust


I'd chalk this off as bad practice

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!