- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-13-2023 11:04 PM
Due to VA Scanner scan my firewall having vulnerabilities of SSL Certificate Chain Contains RSA Keys Less Than 2048 bits .
So I plan to follow below KB to change the key size.
In the KB mentioned as below, may I know clear the certificate cache will have any impact ? and change the keysize require to reboot firewall ?
09-14-2023 02:20 AM
Hi @JiaXiang ,
I believe you are not interperting the findings from your VA scan properly.
The link you mentioned will effect how PAN firewall is performing SSL decryption, while I am expecting your VA scan to have report that PAN firewall admin WebUI is using server cert with short key. What you are probably looking for is here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC
09-14-2023 05:29 PM
Thanks for sharing if follow the KB steps to disable the weak cipher . Require to reboot the firewall ? what is the impact if currently I have certificate is using one of the weak cipher ?
09-15-2023 12:03 AM
Hi @JiaXiang ,
I haven't done this procedure yet, so I am not completely sure. But I am almost certain that it doesn't require reboot, why:
- WebUI is controlled by the management plane.
- Here you can see the process responsible for serving the admin webui - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO
- I would assume changing the ciphers will require restart only for that particular process, which has nothing to do with the dataplane - which is reponsible for processing traffic.
Based on the above I am almost certain that applying the changes will not have any effect on forwarded traffic. Only the current admin sessions using the WebUI will be closed (while process restart). Admin SSH sessions probably wouldn't be affected as well.
09-15-2023 12:25 AM
Thank you, I test first .
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!