Manage: Certificate Management

Centrally manage the certificates you use to secure communication across your network. In one place, set up your certificates, add certificate authorities (Prisma Access includes preloaded certificates for well-known CAs), add OCSP responders, and define certificate checks you want to require. The certificates and settings you set up here can be used throughout your Prisma Access deployment to secure features like decryption, your authentication portal, and the GlobalProtect app.

To ensure trust between parties in a secure communication session, Prisma Access uses digital certificates. Each certificate contains a cryptographic key to encrypt plaintext or decrypt ciphertext. Each certificate also includes a digital signature to authenticate the identity of the issuer. The issuer must be in the list of trusted certificate authorities (CAs) of the authenticating party. Optionally, the authenticating party verifies the issuer did not revoke the certificate.Prisma Access uses certificates to secure features like decryption and authentication, and to secure communication between all the clients, servers, users, and devices connecting to your network. Here are some of the keys and certificates that Prisma Access uses.

Go to ManageConfigurationNGFW and Prisma AccessObjectsCertificate Management.

From this interface, you can manage:

• Custom Certificates—Generate, import, renew, revoke, and export certificates and private key. To generate a certificate, you must first Create a Self-Signed Root CA Certificate or import one (Import a Certificate and Private Key) to sign it. To use Online Certificate Status Protocol (OCSP) for verifying certificate revocation status, add an OCSP Responder before generating the certificate. And as part of generating or importing a certificate, you’ll need to define what type of certificate it is.
  You can export the private key in the following format:
  • Base64 Encoded Certificate (PEM)—This is the default format. It's the most common and has the broadest support on the internet. Export Private Key if you want the exported file to include the private key.
  • Encrypted Private Key and Certificate (PKCS12)—This format is more secure than PEM but isn't as common or as broadly supported. The exported file will automatically include the private key.
  • Binary Encoded Certificate (DER)—More operating system types support this format than the others. You can't export the private key in this format.
• Certificate Profiles—Certificate profiles define user and device authentication for the features and interactions that rely on certificate authentication. The profiles specify which certificates to use, how to verify certificate revocation status, and how that status constraints access. Configure a certificate profile for each of your use cases.
• OCSP Responders—Use Online Certificate Status Protocol (OCSP) to check the revocation status of authentication certificates. The authenticating client sends a request containing the serial number of the certificate to the OCSP responder (server). The responder searches the database of the certificate authority (CA) that issued the certificate and returns a response containing the status (good, revoked or unknown) to the client. The advantage of the OCSP method is that it can verify status in real-time, instead of depending on the issue frequency (hourly, daily, or weekly) of CRLs.
• SSL/TLS Service Profiles—Prisma Access uses SSL/TLS service profiles to specify a certificate and the allowed protocol versions for SSL/TLS services. By defining the protocol versions, you can use a profile to restrict the cipher suites that are available for securing communication with the clients requesting the services. This improves network security by enabling Prisma Access SSL/TLS versions that have known weaknesses. If a service request involves a protocol version that is outside the specified range, the firewall or Panorama downgrades or upgrades the connection to a supported version.
• Default Trusted Certificate Authorities (CAs))—Prisma Access trusts the most common and trusted authorities (CAs) by default. These trusted certificate providers are responsible for issuing the certificates the firewall requires to secure connections to the internet.The only additional CAs you might want to add are trusted enterprise CAs that your organization requires.