Wildcard certificate for management interface access

[Ben-Price]

Hi,

A client is trying to install a wildcard certificate on their firewall for management access, but is receiving a certificate error in the browser. 

Is the below the correct way to generate the required CSR for the firewall for a wildcard certificate?

Can a certificate with the attributes shown be uploaded to the firewall and work, without a CSR being generated on the firewall?

@BPry 

[kiwi]

Hi @Ben-Price ,

In order to get better traction for this, I have moved your post to the General Topics area, as the Feedback area is only for feedback to the LIVE community. 

I would recommend that you visit the General Topics area to see and follow up on your discussion.

Cheers,

-Kiwi.

[rmfalconer]

What's the error they get?

If you use a PKCS12 certificate that includes a private key, you can upload a certificate without a CSR being generated on the PA.

Why would you use a wildcard for a device management certificate?

[Ben-Price]

@rmfalconer Thanks for the feedback. Client is using the wildcard for GP and Management interface. Wildcard cert is working for GP. Client said the Wildcard certificate was working for the Mgmt Interface, when they were on PAN OS 10.0.9, they rolled back to 10.0.8 as they were having commit issues on 10.0.9 and now on 10.0.8 the certificate is broken. I don't see any known issues for this type of thing in PAN OS 10.0.8.

[BPry]

@Ben-Price,

Have you inspected the certificate and actually verified that the rollback didn't somehow break the firewall's service profile association? I can't say I've ever used a wildcard for our firewalls, I just issue them their own certificates through internal PKIs instead, but it should work perfectly fine just testing it out in my lab. I would expect to have additional information detailed in the certificate (Country, State, Org is generally the minimum I've seen referenced), but as long as it's signed by your internal CA that shouldn't matter. 

The error that you have in your screenshot though points to an issue with the actual issuing certificate authority trust. That makes me think that it either wasn't signed, it's presenting an unexpected certificate versus what the customer is expecting, or it's reverted back to the default and removed the specified SSL/TLS service profile that used to be specified while it was working. 

[Ben-Price · Accepted solution]

Deleted the wildcard certificate and re-imported and that has fixed the issue.