SSL Inspection

[jeromecarrier]

Hello

I configured my firewall with SSL decryption. Regarding the certificate, what is the best practice ? Is-it to generate the certificate used for Outbound traffic from our internal PKI (with the problem to deploy the certificate on Linux system or application who not use Windows store) or to generate certificate from our public authority ?

BR

[rmfalconer]

If you have a lot of machines/applications that don't trust your internal and do trust your public, then it's probably worth the few hundred dollars to just issue from public. You also get the benefit that public authorities typically remind you of expiration. We use internal CA for decrypt but we're all Windows and Mac where we can control cert stores.

The main drawback is the very possible change of publicly issues certs going to 90 day expiration at some point in the future.

[zGomez]

Hi Jerome,

You will not be able to use your public PKI infrastructure because most of them don't issue a sub CA certificate.   You need a Sub CA certificate in order for the firewall to generate certificates for the websites you are visiting.

Best practices is to use an internal PKI you manage because in a Windows world this make redistributing the SubCA certificate easy.

there is a difference between the certificates you create and use for web servers and the one you will be using for SSL decryption.

But if you are all linux and you need to deploy the certificates to the clients anway you can create a subCA cert on the palo itself.

[S_Williams901]

Internal PKI like MS windows CA, usually if you have this already all your domain clients will have a RootCA or a SubCA, then generate a cert on the palo and cut the new internal cert from internal CA. 

https://www.justus.ws/tech/paloalto-ca-cert/