ssl decryption and temp cert management

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

ssl decryption and temp cert management

L4 Transporter

Hi

 

I ran into an issue with the decryption cert being provide by my PA it had expired.

 

it was 30 days in. I believe this is an issue with the date time comparision and timezones as it has fixed itself today.

 

How do i find / look at these temp certs via the cli

how can i delete / renew or purge them from the cli 

 

 

 

A

5 REPLIES 5

L7 Applicator

Renew:

request certificate renew certificate-name <value> days-till-expiry <1-7300>

Revoke:

request certificate revoke certificate-name <value>

Show:

configure
show shared certificate-profile <name>

Show the expiration dates of all certs on the firewall:

set cli config-output-format set
configure
show shared certificate | match not-valid-after

 

In the CLI you can use this command to find other commands:

find command keyword <value>

 

These are not the certs created by the ssl proxy 

 

 

Should add my Support Engineer basically said you can't see them.

 

@Alex_Samad

Ups ... I (completely) misunderstood something here 😛

... in this case the possible commands you can find here: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-View-SSL-Decryption-Information-f...

With this command you can show at least some of the information that you asked for:

show system setting ssl-decrypt certificate-cache

 

And yes, a certificate managment isn't really possible with these dynamically created certs.

L7 Applicator

Or also always a good start to find TLS decryption informations: https://live.paloaltonetworks.com/t5/Management-Articles/SSL-decryption-resource-list/ta-p/70397

thats strange

I do this

show system setting ssl-decrypt certificate-cache | match flynumber

 

 

I know flynumber is in there , but this comes back with nothing 

 

 

  • 2728 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!