Impact after Changing the key size setting clears the current certificate cache.

[JiaXiang]

Due to VA Scanner scan my firewall having vulnerabilities of SSL Certificate Chain Contains RSA Keys Less Than 2048 bits .

So I plan to follow below KB to change the key size.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management/configure-the-key-...

In the KB mentioned as below, may I know clear the certificate cache will have any impact ?  and change the keysize require to reboot firewall ? 

Changing the key size setting clears the current certificate cache.

[aleksandar.astardzhiev]

Hi @JiaXiang ,

I believe you are not interperting the findings from your VA scan properly.

The link you mentioned will effect how PAN firewall is performing SSL decryption, while I am expecting your VA scan to have report that PAN firewall admin WebUI is  using server cert with short key. What you are probably looking for  is here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

[JiaXiang]

Thanks for sharing if follow the KB steps to disable the weak cipher . Require to reboot the firewall ? what is the impact if currently I have certificate is using one of the weak cipher ?

[aleksandar.astardzhiev]

Hi @JiaXiang ,

I haven't done this procedure yet,  so I am not completely sure. But I am almost certain that it doesn't require reboot, why:

- WebUI is controlled by the management plane.

- Here you can see the process responsible for serving the admin webui - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO

- I would assume changing the ciphers will require restart only for that particular process, which has nothing to do with the dataplane - which is reponsible for processing traffic.

Based on the above I am almost certain that applying the changes will not have any effect on forwarded traffic. Only the current admin sessions using the WebUI will be closed (while process restart). Admin SSH sessions probably wouldn't be affected as well.

[JiaXiang]

Thank you, I test first .