To test this feature, visit your live site.

Doubt with Subordinate-CA Cert in PA firewall

Good evening, for issues related to for example decrypt as we need a certificate type CA, we can generate a certificate Subordinate-Ca from for example our CA server enterprise windows, import in our Palo Alto Firewall and as customers trust it, it would be transparent for issues such as the use of decrypt.

I have an additional doubt, and while I know that the role of the firewall is not to issue certificates, however, by having this Subordinate-CA in Palo Alto, that means that you can generate certificates, signed by the Subordinate-Ca in Palo Alto no? Example for ABC reason, the access to the Windows server CA is not available or someone will make the decision to do so, could new certificates be created and signed from Palo Alto signed by the Subordinate-Ca ? Example to create certificates that could potentially be used by the web-gui of the managmente device is this true or not ? I know this is not the best practice, in fact it is a lousy practice, based on the and services offered by each component of the infrastructure and network, but eventually it is something that could be done ? And in the same case, you should also upload the certificate of the main CA of the PKI Enterprise internal PKI to comply with the chain ? or with the Subordinate-Ca would be enough to generate new certificates potentially valid ?

Thanks for the collaboration, your time and the clarification of the doubts.

Best regards.

5 comments

Comments (5)

Reaper

Jul 14, 2022

Correct, juat make sure the entire 'chain' is on the firewall so it can prove the chain of authority (install the root on the firewall also) That way the client will trust the cert and the sub

Reaper

Jul 14, 2022

Yes that should be the case, internal clients will trust the server certs

MetgatzGR

Jul 14, 2022

Replying to

Hello Reaper

As always, thanks for your time and for responding.

Reviewing this video https://www.youtube.com/watch?v=yUeP-6idTMM

Use a subordinate-CA and to build the correct Chain import the CA certificate.

In this one too:

https://www.justus.ws/tech/paloalto-ca-cert/#:~:text=And%20import%20it,configuring%20SSL%20decryption.

And in fact it says in the previous link:

Commit your changes, and you're done! "All your ActiveDirectory devices should now trust any certificates issued by your PaloAlto", and you can proceed with configuring SSL decryption."

Just what we mentioned.

Stay tuned

Reaper

Jul 14, 2022

You are right that you would be able to sign server certificates from the imported subordinate. I'm not entirely sure if in "the wild" this would work well if the subordinate is not a trusted root CA in the clients' certificate store, or if your root CA is not explicitly added as a trusted root I.e. for internal clients these 3rd gen server certs will likely work, but for external users they may not

MetgatzGR

Jul 14, 2022

Replying to

Hello @Reaper

Thank you for your reply. Of course, thinking about the internal clients, it would be that from the infra Windows, force the push of the Subordinate certificate to the clients of the Windows network, to the storage of trusted certifying entities, with that they will already trust it and of course for the external ones the warning will appear.

On the other hand I understand that everything signed by the windows CA explicitly clients who are part of it and trust it, should trust everything generated by the internal CA, in this case the certificate of Subordinate-CA would also apply to it, therefore what the Subordinate-CA also signs the internal clients of Windows environments, if they should trust implicitly, if they trust everything that makes say and generates the internal CA.

I remain attentive, best regards.

Forum: Forum