Impact after Changing the key size setting clears the current certificate cache.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Impact after Changing the key size setting clears the current certificate cache.

L4 Transporter

Due to VA Scanner scan my firewall having vulnerabilities of SSL Certificate Chain Contains RSA Keys Less Than 2048 bits .

So I plan to follow below KB to change the key size.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management/configure-the-key-...

 

In the KB mentioned as below, may I know clear the certificate cache will have any impact ?  and change the keysize require to reboot firewall ? 

Changing the key size setting clears the current certificate cache.
4 REPLIES 4

Hi @JiaXiang ,

I believe you are not interperting the findings from your VA scan properly.

The link you mentioned will effect how PAN firewall is performing SSL decryption, while I am expecting your VA scan to have report that PAN firewall admin WebUI is  using server cert with short key. What you are probably looking for  is here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

Thanks for sharing if follow the KB steps to disable the weak cipher . Require to reboot the firewall ? what is the impact if currently I have certificate is using one of the weak cipher ?

Hi @JiaXiang ,

I haven't done this procedure yet,  so I am not completely sure. But I am almost certain that it doesn't require reboot, why:

- WebUI is controlled by the management plane.

- Here you can see the process responsible for serving the admin webui - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO

- I would assume changing the ciphers will require restart only for that particular process, which has nothing to do with the dataplane - which is reponsible for processing traffic.

 

Based on the above I am almost certain that applying the changes will not have any effect on forwarded traffic. Only the current admin sessions using the WebUI will be closed (while process restart). Admin SSH sessions probably wouldn't be affected as well.

 

 

Thank you, I test first .

  • 1904 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!