Warnings: External Dynamic List <list> is configured with no certificate profile.

[DaBone]

Warnings:

External Dynamic List <list> is configured with no certificate profile.

Please select a certificate profile for performing server certificate validation.

Customer went from 7.1.x to now 8.0.x and is using a MineMeld link in the External Dynami List(EDL).  This link is to a https site. 

We followed this link:

https://live.paloaltonetworks.com/t5/MineMeld-Articles/How-to-Generate-New-MineMeld-HTTPS-Cert/ta-p/...

After doing this, the warning was still there.

We had also done this:

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/policy/disable-authentication-for-an...

So when we went to choose a certificate profle, there was not an option to choose one.

Because of this, we force the certificate profile via the CLI:

# set shared external-list Minemeld-Office-365-IP type ip certificate-profile <cert profile>

This resolved this issue.  Then MineMeld went to update the list and there was an Auth error and the list emptied.

Error:
description contains 'EDL server certificate authentication failed. The associated external dynamic list has been removed, which might impact your policy. EDL Name: Minemeld-Office-365-IP, EDL Source URL: https://10.x.xxx.xx/feeds/office365_IPv4s, CN: norminemeld, Reason: SSL peer certificate or SSH remote key was not OK'

The customer then went back to Panorama and removed the cert profile.

We have also looked at this post:
https://live.paloaltonetworks.com/t5/General-Topics/Panorama-8-0-EDL-amp-Certificate-Profile/m-p/148...

Namely the second to the last comment by: PerTenggren

After further investigation it seems that EDL created as "shared" can't list any certificate profile, but it works if assigning the EDL to a specific device group.

Customer said that: All of our policies that reference the Minemeld external dynamic list are Shared (global) in nature and cannot see a local EDL.

Customer is wanting to not see this warning message after commits.

[mteachout]

What was the fix? Is it something you had to change or is it included in a later release?

[FarzanaMustafa · Accepted solution]

I also faced same issue. TAC has advised to try this.

As far as EDL warning is concerned, cert profile need to be configured to verify server certificate using CA that signed CA cert.

There are two ways to resolve warning

1) use http instead of https to connect to webserver in EDL config
2) Or, configure cert profile using root CA that signed web server cert, Global sign in this case and use it in cert profile under EDL.

[andrew571]

The real issue with the use of certificate profiles on external dynamic lists is that the firewall administrator has no control over the actions of 3rd party external dynamic list providers.

• The list provider might force you to use HTTPS.
• The list provider is free to choose whichever SSL Certificate provider they want.
• If the certificate profile becomes invalid due to SSL certificate provider change, the list empties out, and you have no notification of this.
• So, how exactly does this provide security if it suddenly fails open?
• The GUI's "None (Disable Cert profile)" is a misnomer since it doesn't disable it to the point of no longer warning on policy commit.

A proper fix would be that "None (Disable Cert profile)" does what it says it will do which is to not use it and by disabled means it won't warn about it either.

[Tobi]

Unfortunately I still cannot attach a cert-profile to my "shared" EDLs under PAN-OS 9.1. Is this fixed with version 10 or 10.1?

[andrey11]

You can try following:

1. Push Certificate Profile via template to all firewalls.
2. Create the required EDL with the certificate profile on any device group
3. Commit and Push
4. Clone the EDL from the device group as a shared EDL.
5. You can then select the Certificate Profile in the Shared EDL.