Configure Certificate Selection in Prisma Access Agent (config.json)

1. Edit the configuration file (config.json) file to be used for the deployment of Prisma Access Agent.
2. Add or modify the following parameters within the JSON structure:

   • Client Certificate Lookup Store
     • Parameter Name: client_cert_lookup_store
     • Possible Values:
       • user—Agent searches only in the certificate store of the currently logged-in user
       • machine—Agent searches only in the local machine's certificate store
       • user_then_machine—Agent searches first in the user store, then in the machine store if no certificate is found (Default)
   • Extended Key Usage (EKU) OIDs for Client Certificate
     • Parameter Name: client_cert_eku_oid_list
     • Value Format: Comma-separated OID strings. This value can be empty, have one value, or a list of values.
     • Common OIDs:
       • Client Authentication (1.3.6.1.5.5.7.3.2) (Default if not specified)
       • Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
       • Any Extended Key Usage (2.5.29.37.0)
       • IPSec End System (1.3.6.1.5.5.7.3.5)
       • IPSec Tunnel (1.3.6.1.5.5.7.3.6)
       • IPSec User (1.3.6.1.5.5.7.3.7)
       • OCSP Signing (1.3.6.1.5.5.7.3.9)

   Example Configurations:

   To search only in the user store for certificates with Client Authentication, Server Authentication, and OCSP Signing OIDs:

   {
        "server_url":"xxxxx.epm.gpcloudservice.com,
        "tenant_id":"xxxxxxxxxx",
        "unload_gp":true,
        "client_cert_lookup_store" : "user",
        "client_cert_eku_oid_list": [
             "1.3.6.1.5.5.7.3.2",
             "1.3.6.1.5.5.7.3.1",
             "1.3.6.1.5.5.7.3.9"
        ]
   }

   To search only in the machine store for certificates with the Client Authentication OID:

   {
        "server_url":"xxxxx.epm.gpcloudservice.com",
        "tenant_id":"xxxxxxxxxx",
        "unload_gp":true,
        "client_cert_lookup_store" : "machine",
        "client_cert_eku_oid_list": ["1.3.6.1.5.5.7.3.2"]
   }

   To search first in the user store and then the machine store for certificates with the Client Authentication OID (default for unspecified client_cert_eku_oid_list value):

   {
        "server_url":"xxxxx.epm.gpcloudservice.com",
        "tenant_id":"xxxxxxxxxx",
        "unload_gp":true,
        "client_cert_lookup_store" : "user_then_machine",
        "client_cert_eku_oid_list": []
   }

3. Save the config.json file and deploy it along with the Prisma Access Agent.
4. Monitor the certificate activity by reviewing the Prisma Access Agent logs on the endpoints.

   The agent logs activity in the PAS.log file on Windows. On macOS, the activity is logged in the PAS.log and PAUI.log files. The agent stores the following information in the logs:

   • Certificate lookup store and EKU OIDs configured in config.json
   • Whether the certificate selection passed or failed