SSL decryption. What kind of the certificate l can use?

[Transporter]

Hi Guys,

Can you explain to me what types of the certificates l can use and where can l get them from?  For SSL decryption, we do not want to use the self-signed cert.

Thank you,

Mykhaylo

[bmorris1 · Accepted solution]

Hello Mykhaylo,

You will need a root certificate/subordinate certifcate. Essentially you need a certificate that will be used to generate a new certificate based off the original certificate in the handshake, the certificate that is generated will then be signed by the certificate you choose for decryption.

It is highly unlikely you will get a certificate like this from a public authority, if you could get this kind of certificate then you could decrypt public traffic which would invalidate the use of public key infrastructure on the internet.

hope this helps,

Ben

[pankaku]

Hi Mykhaylo,

We have to use a root CA certificate for decryption. We should have both root ca certificate public key and private key.

Why we need root ca is because whenever a client initiate a ssl handshake to a server firewall will intercept that request and then firewall will send a client hello from itself to server now server will reply for that client hello with server hello and it will also give a certificate. Firewall will take all field of the certificate sent from server and generate a similar certificate sign this new certificate with root CA  cert this newly signed certificate is forwarded to actual client.  Only a root CA certificate can generate/sign a certificate.

No CA server will give their root CA certificate private key to anyone. So we have to use a selfsigned root certificate.

Hope this helps!

[Transporter]

Thanks guys

[scottsander]

---

@Pankaj.kumar wrote:

Hi Mykhaylo,

We have to use a root CA certificate for decryption. We should have both root ca certificate public key and private key.

Why we need root ca is because whenever a client initiate a ssl handshake to a server firewall will intercept that request and then firewall will send a client hello from itself to server now server will reply for that client hello with server hello and it will also give a certificate. Firewall will take all field of the certificate sent from server and generate a similar certificate sign this new certificate with root CA  cert this newly signed certificate is forwarded to actual client.  Only a root CA certificate can generate/sign a certificate.

No CA server will give their root CA certificate private key to anyone. So we have to use a selfsigned root certificate.

Hope this helps!

---

You don't need to use a root CA certificate.  What I did was issue a subordinate CA certificate from our internal intermediate issuing CA and use that as the Forward Trust Certificate in PAN-OS.  This way, all of our clients already trust certificates issued by the PAN NGFW because they trust the root CA certificate at the base of the chain.  Additionally, if the private key for the Forward Trust Certificate was ever compromised, we could always revoke the certificate using our intermediate CA.

In my opinion, this is a much simpler and more secure method than making the PAN NGFW its own root CA.

[pankaku]

Yes It can be a subordidnate CA cert. Main point is it should be a ca cert.