Portal/Gateway certificate renewals - automation?

[darren_g]

Greetings

With the continued push for shorter and shorter SSL certificate validation periods coming rapidly to a head (in case you missed it - maximum SSL certificate validity is now 200 days, will go down to 100 days in March 2027, and 47 days in 2029), I'm looking for a way to automate SSL certificate renewals on my Global Protect gateways/portals.

Has anyone com up with a solution that works? Some way of automating SSL renewal - be it via something like LetsEncrypt or a regular CA's process?

Please, if you have - share your magic! Having to remember to renew portal/gateway certs every 46 days is going to suck.

[TomYoung]

Hi @darren_g ,

I haven't tried it. but this looks easy and effective.  https://www.linkedin.com/pulse/can-we-configure-palo-alto-firewalls-automatically-obtain-joe-brunner...  It looks like it could use a couple tweaks.  I could easily come up with CURL commands to do the tasks via API in step 6.  You don't need to update the GP portal or gateway, only update the current SSL/TLS Service profile to use the new certificate.  With the CURL commands, everything could be done in one bash script.

Here is a similar article.  https://medium.com/palo-alto-networks-developer-blog/costless-automated-trusted-certificates-on-palo...

Let's see if anyone posts a fully developed and tested script.  Otherwise, I may work on it.

More and more CAs are using ACMEv2.  So, the method should work with a lot of different CAs.

PANW has some Next-Gen Trust Security feature that integrates with SCM (for a fee?).  https://docs.paloaltonetworks.com/next-gen-trust-security/next-gen-trust-security/about-vaas/configu...  At the bottom it says that it does not support automated certificate renewal! What's the point?

Do we really want a built-in ACMEv2 client on each NGFW?  Then each will try to renew the same certificate multiple times?  This may be a good feature for Panorama, or SCM once they get the bugs worked out.  Doing it once for the organization makes sense.  If you don't use either, a standalone Linux server and script should be easy enough.

Thanks,

Tom

[darren_g]

Thanks for the tips and links, Tom. I'll look into them and see if I can make it work.At least there's a starting point, and even if I am not real savvy on the code side, I have people who are and can probably help

It's a shame that PA can't/won't build this into the product automatically - a security company who can't simplify maintaining one of the core requirements for security is not real impressive.