- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
07-04-2020 11:18 PM
I have installed an SSL certificate on my firewall it is working fine for all of our Palo Alto devices except one device as it is showing it is not secure.
I checked and I found that the device is still using the localhost generated certificate. I don’t know how to force it to use the SSL Certificate I installed.
Note that I set up the SSL/TLS Service Profile and chosen the proper certificate from the list of Certificates. Which is the only certificate available?
07-13-2020 02:17 AM
07-21-2020 01:33 AM
In principle:
More to the point, workflow could be:
It is possible to perform it a bit quicker, but longer way is simpler.
07-06-2020 01:50 PM
Hello,
I would say follow the proper setup steps, you could have missed a step.
Regards,
07-07-2020 08:02 AM
Hi @Mohammed_Yasin,
Verify that Commit was successful on the device in question. If it was - reboot and recheck.
Open Support Case if issue persists.
Remember that WebUI certificates are not synchronized in a HA pair.
07-12-2020 12:20 AM
I have reinstalled a certificate that was working fine with my firewall, but suddenly I lost access to the GUI of the firewall.
I tried what is mentioned here in the link below with no luck.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC
07-20-2020 10:51 AM
Dear ,
I need to install webui certificate for both the palo alto , CSR will be signed by internal CA.
Do i need to create CSR from each firewall ? like i can generate from Primary firewall or from both ?
Should i incude FQDN of each firewall as the common name while generate CSR ?
I can see the certificate are synchronising each other, but TLS profile not ?
Please assist me @OtakarKlier @ACieszkowski
07-20-2020 11:16 AM
Just the one should do. Dont need the firewall names since the certificate is just being used between the PAN and the client.
07-20-2020 11:20 AM
@OtakarKlier thanks for the quick reply.
so What should i include in Common name while generating CSR ?
Once i uploaded the signed certificate and root CA to the firewall , I need to create ssl/tls profile in both the Palo alto firewall right ?
Then i will add this profile in general setting in both the firewall ?
Correct me if am wrong ?
07-20-2020 11:27 AM
Just the name of the certificate. Its either going to be a self signed CA or a subordinate CA cert.
Ensuring the Proper Certificate Authority on the Firewall and Exporting the CA to Clients
Loading or generating a CA certificate on the Palo Alto Networks firewall is needed, because a Certificate Authority (CA) is required to decrypt traffic properly by generating SSL certificates on the fly. Either create a self-signed CA on the firewall or import a subordinate CA from your own PKI infrastructure. Select Forward Trust Certificate and Forward Untrust Certificate on one or more certificates to enable the firewall to decrypt traffic. Because SSL Certificate providers like Entrust, Verisign, Digicert, and GoDaddy do not sell CAs, they are not supported in SSL Decryption.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgHCAS
Cheers!
07-20-2020 11:35 AM
@OtakarKlier thanks for the response .
I am asking for the WebUI certificate , which will be signed by our internal CA (Microsoft CA )
we are not using the public signed certificate.
For Webui, one Certificate is enough for both Palo alto ?
certificate is synronising between the Active/Passive HA , however SSL/Tls profile not ?
i need to create seperate SSL/TLS profile for both the PA ?
07-20-2020 11:37 AM
Sorry, my bad. You will need one cert per device.
07-20-2020 11:46 AM
@OtakarKlier yea , but while generating CSR what should i added in Common name ?
should i generate CSR from both the Firewall or i can generate two CSR from Primary Firwewall added different Common name ?
07-21-2020 01:33 AM
In principle:
More to the point, workflow could be:
It is possible to perform it a bit quicker, but longer way is simpler.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!