>
    Configure an SSL/TLS Service Profile
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Certificate Management
    4. Configure an SSL/TLS Service Profile
    Download PDF

    Configure an SSL/TLS Service Profile

    Table of Contents

    Configure an SSL/TLS Service Profile

    Specify a certificate, TLS protocol versions, and ciphers that you want connections to various Palo Alto Networks services support.
    Where Can I Use This?
    What Do I Need?
    • NGFW (Cloud Managed)
    • NGFW (PAN-OS or Panorama Managed)
    For cloud-managed NGFWs:
    Palo Alto Networks firewalls and Panorama appliances use SSL/TLS to secure connections to the Authentication Portal, GlobalProtect portals and gateways, the management interface, HTTPS websites that require password access (URL admin override), and the User-ID™ syslog listening service. You can create an SSL/TLS service profile to define the server certificate, SSL/TLS protocol versions, and ciphers supported for connections to these services. Cipher suites are automatically selected based on the protocol versions chosen. However, you can disable individual ciphers as needed. If a service request involves a protocol version outside the specified range, the firewall or Panorama appliance downgrades or upgrades the connection to a supported version. To activate an SSL/TLS service profile, attach the profile to the settings for a specific service.
    In the client systems that request firewall services, the certificate trust list (CTL) must include the certificate authority (CA) certificate that issued the certificate specified in the SSL/TLS service profile. Otherwise, users will see a certificate error when requesting firewall services. Most third-party CA certificates are present by default in client browsers. If an enterprise or firewall-generated CA certificate is the issuer, you must deploy that CA certificate to the CTL in client browsers.
    TLSv1.3 support is limited to administrative access to management interfaces and GlobalProtect portals and gateways. You can only attach SSL/TLS service profiles that allow TLSv1.3 to the settings for these services.

    Cloud Management

    Configure an SSL/TLS service profile on Strata Cloud Manager.
    You can configure an SSL/TLS service profile on Strata Cloud Manager.
    1. Log in to Strata Cloud Manager.
    2. For each desired service, generate or import a certificate.
      1. Select
        Manage
        Configuration
        NGFW and
        Prisma Access
        Objects
        Certificate Management
        Certificates
        .
      2. In the Custom Certificates pane,
        Generate
         or
        Import
         a certificate.
      3. Save
         the certificate.
    3. Configure an SSL/TLS service profile.
      1. Select
        Manage
        Configuration
        NGFW and
        Prisma Access
        Objects
        Certificate Management
        Certificates
        .
      2. In the SSL/TLS Service Profiles pane, click
        Add Profile
        .
      3. Enter a
        Name
         for the profile.
      4. Select or
        Import
         a
        Certificate
        .
      5. For
        Protocol Settings
        , define the range of TLS versions that the service can use.
        TLSv1.3 support is limited to administrative access to management interfaces and GlobalProtect portals and gateways. You can only attach SSL/TLS service profiles that allow TLSv1.3 to the settings for these services.
        Administrative Access and GlobalProtect Portals and Gateways:
        Set the
        Min Version
         and
        Max Version
         to
        TLSv1.3
        .
        • For the
          Min Version
          , select the earliest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          ,
          TLSv1.2
          , or
          TLSv1.3
          .
        • For the
          Max Version
          , select the latest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          ,
          TLSv1.2
          , or
          TLSv1.3
          .
        All Other Services:
        Set the
        Min Version
         and
        Max Version
         to
        TLSv1.2
        .
        • For the
          Min Version
          , select the earliest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          , or
          TLSv1.2
          .
        • For the
          Max Version
          , select the latest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          , or
          TLSv1.2
          .
    4. (
      Optional
      ) Deselect any
      Key Exchange Algorithms
      ,
      Encryption Algorithms
      , or
      Authentication Algorithms
      .
    5. Save
       the profile.
    6. Push Config
      .

    PAN-OS & Panorama

    PAN-OS: Specify a certificate, TLS protocol versions, and ciphers that you want connections to various Palo Alto Networks services support.
    1. For each desired service, generate or import a certificate on the firewall (see Obtain Certificates).
      Use only signed certificates, not CA certificates, in SSL/TLS service profiles.
    2. Select
      Device
      Certificate Management
      SSL/TLS Service Profile
      .
    3. If the firewall has more than one virtual system (vsys), select the
      Location
       (vsys or
      Shared
      ) where the profile is available.
    4. Click
      Add
       and enter a
      Name
       to identify the profile.
    5. Select the
      Certificate
       you obtained in step one.
    6. Under
      Protocol Settings
      , define the range of TLS versions that the service can use.
      TLSv1.3 support is limited to administrative access to management interfaces and GlobalProtect portals and gateways. You can only attach SSL/TLS service profiles that allow TLSv1.3 to the settings for these services.
      • Administrative Access and GlobalProtect Portals and Gateways:
        Set the
        Min Version
         and
        Max Version
         to
        TLSv1.3
        .
        • For the
          Min Version
          , select the earliest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          ,
          TLSv1.2
          , or
          TLSv1.3
          .
        • For the
          Max Version
          , select the latest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          ,
          TLSv1.2
          , or
          TLSv1.3
          .
      • All Other Services:
        Set the
        Min Version
         and
        Max Version
         to
        TLSv1.2
        .
        • For the
          Min Version
          , select the earliest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          , or
          TLSv1.2
          .
        • For the
          Max Version
          , select the latest allowed TLS version:
          TLSv1.0
          ,
          TLSv1.1
          , or
          TLSv1.2
          .
    7. (
      Optional
      ) Deselect any
      Key Exchange Algorithms
      ,
      Encryption Algorithms
      , or
      Authentication Algorithms
      .
    8. Click
      OK
       and
      Commit
       your changes.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.