Symantec Certificate can use for SSL Decryption in PA Firewall

[Rahimbhamani]

As per forum, we generate the self signed certificate or Subordinate of CA template certificate for decryption of SSL Traffic on Palo Alto. If we purchase symantec certificate can we use for ssl decryption? As per symantec they cannot generate Subordinate of CA template certiicate.

[TranceforLife]

Hi,

You have to have a root CA or intermediate CA (both can sign/resign new certificates). As per guide:

A Certificate Authority (CA) is required to decrypt traffic properly by generating SSL certificates on the fly. Create a self-signed CA on the firewall or import a Subordinate CA (from your own PKI infrastructure). Select "Forward Trust Certificate" and "Forward Untrust Certificate" on one or more certificates to enable the firewall to decrypt traffic.

Note: Because SSL Certificate providers like Entrust, Verisign, Digicert, and GoDaddy do not sell CAs, they are not supported in SSL Decryption.

Symantec will sell you the bottom certificate (end user cert) as per pic below so the one that isn't supported for SSL Decryption:

[bradk14]

to build on that, you will basically need an internal CA and then deploy the root CA certificate to each of your clients so they inherently trust the certificates that the PA will generate for each site decrypted. Or you can do the same with a self signed cert from PA, but the internal CA is a better option, especially in the long run.

and to add confusion, while you can't just buy a subordinate CA from public issuers, several do offer private/managed services such as Symantec and Entrust, which will let you obtain the right certificate for SSL decryption.