Configure a Custom Certificate for a Panorama Managed WildFire Appliance

1. Obtain key pairs and certificate authority (CA) certificates for the WildFire appliance and the firewall.
2. Import the CA certificate to validate the identity of the firewall and the key pair for the WildFire appliance.

   1. Select PanoramaCertificate ManagementCertificatesImport.
   2. Import the CA certificate and the key pair on Panorama.
3. Configure a certificate profile that includes the root CA and intermediate CA. This certificate profile defines how the WildFire appliance and the firewalls authenticate mutually.

   1. Select PanoramaCertificate ManagementCertificate Profile.
   2. Configure a certificate profile.

      If you configure an intermediate CA as part of the certificate profile, you must also include the root CA.
4. Configure an SSL/TLS profile for the WildFire appliance.

   PAN-OS 8.0 and later releases support only TLS 1.2 and higher so ou must set the max version to TLS 1.2 or max.

   1. Select PanoramaCertificate ManagementSSL/TLS Service Profile.
   2. Configure an SSL/TLS service profile to define the certificate and protocol that the WildFire appliance and its the firewalls use for SSL/TLS services.
5. Configure Secure Server Communication on WildFire.

   1. Select PanoramaManaged WildFire Clusters or PanoramaManaged WildFire Appliances and select a cluster or appliance.
   2. Select Communication.
   3. Enable the Customize Secure Server Communication feature.
   4. Select the SSL/TLS Service Profile. This SSL/TLS service profile applies to all SSL connection between the WildFire appliance and the firewall or Panorama.
   5. Select the Certificate Profile you configured for communication between the WildFire appliance and the firewall or Panorama.
   6. Verify that Custom Certificates Only is disabled (cleared). This allows the WildFire appliance to continue communicating with the firewalls with the predefined certificate while migrating to custom certificates.
   7. (Optional) Configure an authorization list.

      1. Add an Authorization List.
      2. Select the Subject or Subject Alt Name configured in the certificate profile as the Identifier type.
      3. Enter the Common Name if the identifier is Subject or enter an IP address, hostname, or email if the identifier is Subject Alt Name.
      4. Click OK.
      5. Enable Check Authorization List to enforce the list.
   8. Click OK.
   9. Commit your changes.
6. Import the CA certificate to validate the certificate for the WildFire appliance.

   1. Log in to the firewall web interface.
   2. Import the CA certificate.
7. Configure a local or SCEP certificate for the firewall.

   • If you are using a local certificate, import the key pair for the firewall.
   • If you are using SCEP for the firewall certificate, configure a SCEP profile.
8. Configure the certificate profile for the firewall or Panorama. You can configure this profile on each client firewall or Panorama appliance individually or you can use a template to push the configuration from Panorama to managed firewalls.

   1. Select DeviceCertificate ManagementCertificate Profile for firewalls or PanoramaCertificate ManagementCertificate Profile for Panorama.
   2. Configure a Certificate Profile.
9. Deploy custom certificates on each firewall or Panorama appliance.

   1. Log in to the firewall web interface.
   2. Select DeviceSetupManagement for a firewall or PanoramaSetupManagement for Panorama and Edit the Secure Communication Settings.
   3. Select the Certificate Type, Certificate, and Certificate Profile.
   4. In the Customize Communication settings, select WildFire Communication.
   5. Click OK.
   6. Commit your changes.
10. After deploying custom certificates on all managed devices, enforce custom-certificate authentication.

    1. Log in to Panorama.
    2. Select PanoramaManaged WildFire Clusters or PanoramaManaged WildFire Appliances and select a cluster or appliance.
    3. Select Communication.
    4. Select Custom Certificate Only.
    5. Click OK.
    6. Commit your changes.

    After committing this change, WildFire immediately begins the enforcement of custom certificates.