Due to VA Scanner scan my firewall having vulnerabilities of SSL Certificate Chain Contains RSA Keys Less Than 2048 bits .
So I plan to follow below KB to change the key size.
In the KB mentioned as below, may I know clear the certificate cache will have any impact ? and change the keysize require to reboot firewall ?
Hi @JiaXiang ,
I believe you are not interperting the findings from your VA scan properly.
The link you mentioned will effect how PAN firewall is performing SSL decryption, while I am expecting your VA scan to have report that PAN firewall admin WebUI is using server cert with short key. What you are probably looking for is here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC
Hi @JiaXiang ,
I haven't done this procedure yet, so I am not completely sure. But I am almost certain that it doesn't require reboot, why:
- WebUI is controlled by the management plane.
- Here you can see the process responsible for serving the admin webui - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLUeCAO
- I would assume changing the ciphers will require restart only for that particular process, which has nothing to do with the dataplane - which is reponsible for processing traffic.
Based on the above I am almost certain that applying the changes will not have any effect on forwarded traffic. Only the current admin sessions using the WebUI will be closed (while process restart). Admin SSH sessions probably wouldn't be affected as well.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!