What certificate to use for Palo Alto-provided EDL validation

[paolopoz]

Hello all,

I am trying to tide up a bit the EDL configuration in our Panorama.

We are using  some of the EDLs which Palo Alto provides as optional.

Following the official documentation at this link:

https://docs.paloaltonetworks.com/network-security/security-policy/administration/objects/external-d...

I need to use the GlobalSign Root certificate to authenticate the EDL Hosting Service.

However if I follow other guides (for example this YT video: https://www.youtube.com/watch?v=Vpy677VOV20 ) and I do it for Palo Alto Hosting Service I find a different root certificate provided by Google and which is obviously different from the one referred to into the docs.

At this point I do not know which one to use. Do you have any advice?

Thanks.

[TomYoung · Accepted solution]

Hi @paolopoz ,

Always follow the steps in the video.  Browse to your EDL URL and view the certificates in the browser.  Those certificates are the ones the site is using.  I use certificate profiles with all my EDLs.  Sometimes the sites change their certs, but otherwise you set it up once and it works.  Like the video, I download and add every certificate in the chain to my certificate profile.

Thanks,

Tom

[paolopoz]

Thank you @TomYoung !

I provided a feedback on that documentation page so that hopefully it can be updated.