Integrate cloud-native key managers to store certificates.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
- AWS account
- Amazon Machine Image (AMI) ID
- VM-Series License (PAYG or BYOL)
- VM-Series plugin
- Panorama
- Panorama plugin for AWS
|
You can integrate cloud-native key managers to store certificates. Private
keys used for certificates are not stored on a firewall’s hard drive, thereby
eliminating security problems. Administrators retain certificates and private keys
in cloud storage. The firewall uses AWS Secrets Manager to retrieve the certificates
and private keys from cloud storage, and uses them for features like decryption and
IPSec.
Only VM-Series firewalls are supported to enable certificate retrieval via AWS
Secrets Manager. If you're using AWS Secrets Manager certificates, you can’t
downgrade to an earlier version of PAN-OS.
For outbound and inbound decryption, upload the certificates to the native key
manager and provide the required access permissions to the NGFW.An NGFW on a public
cloud can use AWS Secrets Manager for storing certificates. With such cases, the
required access management policies are configured, using PAN-OS or the CLI, for the
same instances.
For environments using autoscaling, an instance boots up in a state with the
necessary certificates retrieved and ready to decrypt traffic without additional
manual configuration.
When a certificate is updated in the cloud, it must be reimported as a new
certificate onto the firewall. Assign IAM roles to an instance to enable the
instance to retrieve certificates from the AWS Secrets Manager store. The IAM role
must have Get permission for Secrets from AWS Secrets Manager.
All certificates are deleted when a master key changes and then refetched upon
commit. When the configuration is synchronized to the passive firewall under HA,
the certificate is automatically downloaded by the management daemon on the
passive firewall. As a result, the certificate itself isn’t synchronized.
