User-id agent secure connection using enterprise CA

[Deepak25]

We are using one user-id agent for four locations and want to use enterprise CA cert to resolve vulnerability detected on port 5007.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGFCA0

Have below queries :

1. Can we generate CSR on firewall and signed the same on enterprise CA , how we can create root cert in this case to use in user-id cert profile?

2. If we imported cert in user-id agent and certificate profile not called in user-id service profile , user-id status will down ?

( cause we don't want user-id agent status down issue at all locations at same time, secure connection setting should be active only after calling certificate profile in user-id service profile )

3. is there any safe way to tshoot this ?

[BPry]

@Deepak25,

1. The CSR is generally not done on the firewall. The CSR would be specific for the UIA and signed by your enterprise CA. I would imagine that your firewall already has your root and intermediary so that when used in the cert profile your firewall will trust the certificate being presented by the UIA.

2. You can import the cert in the UIA before you configure your firewalls to utilize the connection security feature. It won't be checked by your firewall until they've been configured to actually validate the certificate. 

3. I would recommend validating your certificates are going to be trusted by doing this on a lab device if you have one. There's no way to verify the certificate profile on the firewall is going to capture the UIA certificate unless you actually have one use it. You can go the manual validation route, but obviously that's prone to error. 

[Deepak25]

Thanks @BPry 

Regarding 1st point, as per below KB we can generate CSR in Palo Alto firewall. And get signed by enterprise CA. Please confirm on same.

Regarding 2nd point, so if are importing cert in user-id agent and not calling certificate profile in user-id connection security in firewall, there will be no issue in user-id status. right?