Adding an External Dynamic List Object and importing the Intermediate CA certificate from the external web server that the EDL is hosted on

[user9891]

I am trying to add an External Dynamic List to our PA-440. 

The External Dynamic List is hosted on an external web server by one of our security partners.  This web server is https enabled and authentication is via username/password.  This is the screenshot when you go to the EDL's Source URL:

According to this documentation, in order for the firewall to authenticate to this server, I will need to add the Intermediate CA certificates that match the certificates installed on the server the firewall is authenticating.  With that profile, I will have the option to add a username and password to the External Dynamic List object when I add the correct Certificate Profile.

Here is the documentation that states I need to add the Intermediate CA certificates that match the certificates installed on the server the firewall is authenticating:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

My understanding of this is I needed to:

1. Download the Intermediate CA certificate from the external web server that's hosting the EDLs
2. Import this Intermediate CA certificate into the Certificate Manager
3. Create a Certificate Profile to add to the EDL object.

Downloading the Intermediate CA Certificate:

To download the Intermediate CA certificate from the external webserver that's hosting the EDLs.

1. Click the lock icon:

2. Click on "Connection Secure":

3. Click on "More Information":

4. Click "View Certificate":

5. Click the middle certificate (the Intermediate CA), scroll down and download the cert file (.PEM)

> Is this the correct file to be downloading?

> The UserTrust CA is already in the list of Trusted Certificate Authorities in the Certificate manager of the PA-440, so this Intermediate CA Certificate is all I should need.

[TomYoung]

Hi @user9891 ,

Yes, that process is correct.  The document actually says to add the root and intermediate to the certificate profile.  That is the process that I use, and it works.  Your reasoning makes sense that the root is already trusted.  Let us know if only the intermediate CA works in the certificate profile.

Thanks,

Tom