For details on cookie usage on our site, read our Privacy Policy
SSL: Firewall uses untrust-forward cert. for every site
- LIVEcommunity
- Discussions
- General Topics
- SSL: Firewall uses untrust-forward cert. for every site
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-26-2013 04:36 AM
Hi,
I just set up SSL Decryption exactly as described in the Getting Started Guide (English)
I have one trusted-forward certificate, imported into browsers, and one untrust-orward certificate, not imported into browsers.
Now when I connect to SSL sites, my browsers complain about untrusted certificates, the firewall is clearly using the untrust-forward certificate. When I configure the imported trust-forward certificate to be the untrust-forward certificate (so the imported certificate is both at the same time), everything works fine.
Something is wrong here. Any ideas?
Thanks
Sascha
- Labels:
-
Set Up
-
Troubleshooting
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
06-01-2013 02:35 AM
Hi,
please forget about it. I deleted all my certificates and re-created them from scratch, rebooted the firewall and now it is working fine. Not sure why it would use the wrong certificate, something must have got messed up. It's working fine now. Thanks for your help guys.
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-26-2013 04:56 AM
Thanks, but I don't think this is my problem. In my case, *every* site is being signed by the untrust-forward certificate. Even large ones like Google or Facebook.
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-26-2013 07:08 AM
I digged a little deeper and it seem the firewall is declaring each site's certificate as "untrusted" (see attached screenshot). So either the firewall is unable to check the certificates or there is some other issue. The list of default trusted CA authorities is populated with roughly 260 entries, so that looks ok. I need some help here, something is going very wrong.
- What is Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack" in Threat & Vulnerability Discussions
- API pull export PAN URL Category's in General Topics
- Can the Palo Alto Firewall autoguarantine users based on the number of violations they have made for a particular time? in General Topics
- IPSec tunnel not working in Next-Generation Firewall Discussions
- Device Certificate: can't replace old device cert by putting in newly generated OTP in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
