- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
06-07-2016 06:08 AM
Hi Guys,
Can you explain to me what types of the certificates l can use and where can l get them from? For SSL decryption, we do not want to use the self-signed cert.
Thank you,
Mykhaylo
06-07-2016 06:57 AM
Hello Mykhaylo,
You will need a root certificate/subordinate certifcate. Essentially you need a certificate that will be used to generate a new certificate based off the original certificate in the handshake, the certificate that is generated will then be signed by the certificate you choose for decryption.
It is highly unlikely you will get a certificate like this from a public authority, if you could get this kind of certificate then you could decrypt public traffic which would invalidate the use of public key infrastructure on the internet.
hope this helps,
Ben
06-07-2016 06:57 AM
Hello Mykhaylo,
You will need a root certificate/subordinate certifcate. Essentially you need a certificate that will be used to generate a new certificate based off the original certificate in the handshake, the certificate that is generated will then be signed by the certificate you choose for decryption.
It is highly unlikely you will get a certificate like this from a public authority, if you could get this kind of certificate then you could decrypt public traffic which would invalidate the use of public key infrastructure on the internet.
hope this helps,
Ben
06-07-2016 07:03 AM
Hi Mykhaylo,
We have to use a root CA certificate for decryption. We should have both root ca certificate public key and private key.
Why we need root ca is because whenever a client initiate a ssl handshake to a server firewall will intercept that request and then firewall will send a client hello from itself to server now server will reply for that client hello with server hello and it will also give a certificate. Firewall will take all field of the certificate sent from server and generate a similar certificate sign this new certificate with root CA cert this newly signed certificate is forwarded to actual client. Only a root CA certificate can generate/sign a certificate.
No CA server will give their root CA certificate private key to anyone. So we have to use a selfsigned root certificate.
Hope this helps!
06-07-2016 08:39 AM
@Pankaj.kumar wrote:
Hi Mykhaylo,
We have to use a root CA certificate for decryption. We should have both root ca certificate public key and private key.
Why we need root ca is because whenever a client initiate a ssl handshake to a server firewall will intercept that request and then firewall will send a client hello from itself to server now server will reply for that client hello with server hello and it will also give a certificate. Firewall will take all field of the certificate sent from server and generate a similar certificate sign this new certificate with root CA cert this newly signed certificate is forwarded to actual client. Only a root CA certificate can generate/sign a certificate.
No CA server will give their root CA certificate private key to anyone. So we have to use a selfsigned root certificate.
Hope this helps!
You don't need to use a root CA certificate. What I did was issue a subordinate CA certificate from our internal intermediate issuing CA and use that as the Forward Trust Certificate in PAN-OS. This way, all of our clients already trust certificates issued by the PAN NGFW because they trust the root CA certificate at the base of the chain. Additionally, if the private key for the Forward Trust Certificate was ever compromised, we could always revoke the certificate using our intermediate CA.
In my opinion, this is a much simpler and more secure method than making the PAN NGFW its own root CA.
06-07-2016 04:37 PM - edited 09-20-2016 03:53 PM
Yes It can be a subordidnate CA cert. Main point is it should be a ca cert.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!