08-13-2024 09:51 AM
Hello,
when a client want to connect to a serveur on thé Internet ,the Palo Alto Networks device intercepts the client SSL request and generates a certificate on the fly for the site the client was visiting. In this step what will be the intermediate chain and the root chain of this new certificate? The same as the server on the internet?
Which key will be used by the client to encrypt traffic between it and the firewall?
What key will the firewall use to decrypt the customer's traffic?
Thanks
08-13-2024 07:29 PM
Hello,
"In this step what will be the intermediate chain and the root chain of this new certificate? The same as the server on the internet?"
- The client would be presented with a cert that is signed by your Forward Trust Certificate that you have selected in your firewall. So if you went to google.com it would be a google.com cert signed by your Forward Trust Certificate.
"Which key will be used by the client to encrypt traffic between it and the firewall?"
- Your Forward Trust Certificate. The firewall wouldn't have access to the private key of a server on the internet (assuming you don't control this server)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
