how to add PA forward decryption certificate to Minemeld

[idelconsulting]

Dear all,

first of all, thanks a lot to all contributors for this great project.

Quick question: I configured my Minemeld instance in my local network and I also have SSL interception configured on my PA.

For the moment I had to exclude the IP of the Minemeld instance from SSL interception because of error messages. I assume that's because Minemeld doesn't trust my forward decryption certificate.

How can I add that to Minemeld?

Regards,

  Andreas

[xhoms]

Hi @idelconsulting,

you need to import the corresponding CA cert and update the cert bundle for MineMeld to trust certs issued by the SSL Decryption function.

Details in https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Certificate-Error-on-Miner-Refresh/m-p/168...

[idelconsulting]

Hi @xhoms

thanks a lot. But so far that didn't work.

I'll ask a question on that other discussion you mentioned.

Regards,

   Andreas

[idelconsulting · Accepted solution]

I added a comment to that other discussion.

The instructions required a couple of minor changes:

I exported my root CA certificate and the forward trust CA certifiacte from the PA.

Exported CA PEM files needs to be in:

/opt/minemeld/local/certs/site

with the extension .crt

Then, run

sudo -u minemeld mm-cabundle-update

Last step is restarting the engine from the  System menu.

Now for me everything is working fine.

Regards,

  Andreas