Wildcard certificate on PA firewalls

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Wildcard certificate on PA firewalls

Hi Team,

 

I'm trying to create a CSR in Panorama in order to get a wildcard certificate from our third party CA.

 

In order platforms, I define as common name the format *.mydomain.com but in Palo Alto I'm getting an error: Failed to generate certificate and key.

 

When I change the common name to .mydomain.com it allows me to create the CSR.

 

I just wanted to touch base with you guys in order to know about your experience working with wildcards on Palo Alto Plattform.

 

Any response will be very appreciated.

 

Thank you,

1 accepted solution

Accepted Solutions

It would help to know Panorama version as @Remo mentioned.

 

In my case Panorama 8.1.4

Works like a charm.

 

wildcard1.PNGwildcard2.PNGwildcard3.PNG

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

View solution in original post

12 REPLIES 12

Cyber Elite
Cyber Elite

Are you choosing Signed by External Authority (CSR)?

Try to change Certificate Name to something else but leave Common Name to *.mydomain.com

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Yup, just tested it as described by @Raido_Rattameister and it successfully generated a CSR for a wildcard cert.

 

(Remember to add *.mydomaim.com also as "hostname" when you generate the CSR)

Thanks for your feedback Raido,

 

Yes Sir, I'm choosing Signed by External Authority (CSR) and I'm still getting the same error. The error clears out when I change the Common name to .mydomain.com (removing the *).

 

For the Certificate Name I'm adding wildcard-mydomain-com.

 

Other thing I forgot to mention was that I'm choosing Algorithm Elliptic Curve DSA.

 

Thanks,

Thanks vsys,

 

I just tested that and got error: "request -> certificate -> generate -> hostname '*.mydomain.com' is invalid"

 

Could you test it for an Elliptic Curve DSA cert?

 

Thanks,

What PAN-OS version do you have installed and are you logged in with a user that has "superuser" privileges?

It would help to know Panorama version as @Remo mentioned.

 

In my case Panorama 8.1.4

Works like a charm.

 

wildcard1.PNGwildcard2.PNGwildcard3.PNG

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L3 Networker

Works fine on PAN OS 7.1.16 too. Defined *.mydomain.com in both CN and hostname feilds with superuser account and it was generated successfully. So was the commit too.

 

pic1.PNG

 

pic2.PNG

@AlexandroDelAngel

I was asking about the version and the permissions because may be you are seeing this bug (which is fixes in PAN-OS 8.0.10):

Screenshot_20181031-124755_Chrome.jpg

Thanks for your feedback Team,

 

Our Panorama is already in 8.0.10 and yes, my account is a superuser. I guess it's time to escalate to PA Support, I just don't want to purchase a useless wildcard certificate.

 

Kind Regards,

Hi @AlexandroDelAngel

 

Yes, looks like there is something wrong. (Did you try the generation with another browser?, if you're using windows - as bad as this sounds - try it once with IE)

And while you talk about this with PA support ... you could simply use tools like openssl to generate the key and CSR for you.

Thanks for the recommendation vsys,

 

I just tried with IE and got the same error, OpenSSL will work fine for sure.

 

Kind Regards,

Hi Team,

 

Thank you very much everyone for your support, I left the Common Name as .mydomain.com and then on the CA directly you can indicate this is a wildcard certificate and they will prepend the * for you so the final result will be *.mydomain.com.

 

Then when I imported the signed certificate it was successful.

 

Kind Regards!

  • 1 accepted solution
  • 9827 Views
  • 12 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!