Doubt with Subordinate-CA Cert in PA firewall

[Metgatz]

Doubt with Subordinate-CA Cert in PA firewall

Good evening, for issues related to for example decrypt as we need a certificate type CA, we can generate a certificate Subordinate-Ca from for example our CA server enterprise windows, import in our Palo Alto Firewall and as customers trust it, it would be transparent for issues such as the use of decrypt.

I have an additional doubt, and while I know that the role of the firewall is not to issue certificates, however, by having this Subordinate-CA in Palo Alto, that means that you can generate certificates, signed by the Subordinate-Ca in Palo Alto no? Example for ABC reason, the access to the Windows server CA is not available or someone will make the decision to do so, could new certificates be created and signed from Palo Alto signed by the Subordinate-Ca ? Example to create certificates that could potentially be used by the web-gui of the managmente device is this true or not ? I know this is not the best practice, in fact it is a lousy practice, based on the and services offered by each component of the infrastructure and network, but eventually it is something that could be done ? And in the same case, you should also upload the certificate of the main CA of the PKI Enterprise internal PKI to comply with the chain ? or with the Subordinate-Ca would be enough to generate new certificates potentially valid ?

Thanks for the collaboration, your time and the clarification of the doubts.

Best regards.

[reaper]

The internal clients would trust the server certs, external clients won't have the appropriate chain of trust

I'd chalk this off as bad practice