How to remove DigiNotar CA SSL Root Authority

[mhuels]

i do not find a hint how to remove any SSL Root Authority in my PAN. How can i announce me the trusted SSL Authorities? Is it possible to remove a single CA like "DigiNotar  Root CA".

mfg

Manfred

[mhuels]

Hi Benjamin,

since restarting our firewall (running 3.1.10), we see, for example by surfing on https://balie.culemborg.nl/, a "drop-all-packets" in the threat log. But in fact, the firewall does not drop the traffic nor shows any error or warning in the decrypted certificate. So we have the bizarre situation having error hints in browsers without PA firewall (as all browsers have removed the diginotar CA), but no warnings in browsers which are secured by a PA firewall (because all browsers accepts the PA certificate, which is used to re-encrypt the SSL traffic).

regards

Manfred

[bpappas]

@mhuels:

Have you configured the CRL/OCSP options on the Device tab -> Server CRL / OCSP Settings screen?

-Benjamin

[mhuels]

bpappas schrieb:
@mhuels:
Have you configured the CRL/OCSP options on the Device tab -> Server CRL / OCSP Settings screen?
-Benjamin

Hi Benjamin,

up to now, we did not have configured anything in the CRL/OCSP tab. Since 5 minutes, we have enabled the checking of revocation lists via CRL and OCSP. Testing on https://188.203.119.3, the firewall blocks the ssl traffic (the browsers shows a timeout). Although it would be nicer not to drop but to bring out a security warning or an invalid certificate, this behaviour is tolerable for us. There are not so much diginotar certificates anymore ...

Thanks for your hint.

Manfred