Wildcard certificate for management interface access

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Wildcard certificate for management interface access

L4 Transporter

Hi,

 

A client is trying to install a wildcard certificate on their firewall for management access, but is receiving a certificate error in the browser. 

 

Is the below the correct way to generate the required CSR for the firewall for a wildcard certificate?

BenPrice_0-1646699239332.png

Can a certificate with the attributes shown be uploaded to the firewall and work, without a CSR being generated on the firewall?

@BPry 

 

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Deleted the wildcard certificate and re-imported and that has fixed the issue.

View solution in original post

5 REPLIES 5

Community Team Member

Hi @Ben-Price ,

 

In order to get better traction for this, I have moved your post to the General Topics area, as the Feedback area is only for feedback to the LIVE community. 

I would recommend that you visit the General Topics area to see and follow up on your discussion.

 

Cheers,

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!

L4 Transporter

What's the error they get?

If you use a PKCS12 certificate that includes a private key, you can upload a certificate without a CSR being generated on the PA.

Why would you use a wildcard for a device management certificate?

L4 Transporter

@rmfalconer Thanks for the feedback. Client is using the wildcard for GP and Management interface. Wildcard cert is working for GP. Client said the Wildcard certificate was working for the Mgmt Interface, when they were on PAN OS 10.0.9, they rolled back to 10.0.8 as they were having commit issues on 10.0.9 and now on 10.0.8 the certificate is broken. I don't see any known issues for this type of thing in PAN OS 10.0.8.

BenPrice_0-1646775945791.png

 

Cyber Elite
Cyber Elite

@Ben-Price,

Have you inspected the certificate and actually verified that the rollback didn't somehow break the firewall's service profile association? I can't say I've ever used a wildcard for our firewalls, I just issue them their own certificates through internal PKIs instead, but it should work perfectly fine just testing it out in my lab. I would expect to have additional information detailed in the certificate (Country, State, Org is generally the minimum I've seen referenced), but as long as it's signed by your internal CA that shouldn't matter. 

The error that you have in your screenshot though points to an issue with the actual issuing certificate authority trust. That makes me think that it either wasn't signed, it's presenting an unexpected certificate versus what the customer is expecting, or it's reverted back to the default and removed the specified SSL/TLS service profile that used to be specified while it was working. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!