Certificates on Palo alto - Types to be installed

[N-Open]

Dear memebers,

We are going to use palo alto vm series firewall on Azure and like to take your advice on the type of certificates to be installed. The firewalls will be public facing front end by Azure application gateway.

The FW will be protecting a web site running on the background.  If my understanding is correct, I need 2 types of certificates.

• One from Certificates from a trusted third-party CA (Go dady/Verisign) - This is for web site
• Obtain a Certificate from an External CA - This will be from Palo alto itself for  SSL/TLS decryption 

plz advice if my understanding is correct.

[reaper]

you don't need the second ssl certificate as that is only required for outbound proxy inspection (and it needs to be from an internal PKI or selfsigned instead of a public one)

for inbound inspection, you need to have the server certificate (and preferably the CA/root and intermediate, to complete the certificate path)

you can use the server certificate on the firewall (WITH private key) to look inside the flow