Custom certs for Console access
You can secure access to Console with your own digital certificate.
By default, Prisma Cloud secures access to Console’s web portal and API with a self-signed certificate.
The self-managed certificate generated by Console is valid for three years.
A month prior to expiration, Prisma Cloud will let you rotate it (a banner will appear at the top of the UI).
After rotating Console’s certificate, you must manually redeploy your Defenders.
When you access Console’s web portal with this setup, for example, the browser flags the portal as untrusted with a warning message.
The following screenshot shows the warning message in Chrome:
You can resolve these warnings by installing your own certificate that proves your server’s identity to the client.
With the proper certificate, users are taken directly to Console, and the green padlock in the address bar indicates that the site is trusted.
Creating certificates is outside the scope of this article.
For more information about how SSL and certificates secure a site, see How does HTTPS actually work.
Configuration options
Prisma Cloud secures the communication between various actors and entities with certificates.
These certs are automatically generated and self-signed during the Prisma Cloud install process.
They secure communication between:
- Users and the Console web portal.
- Users and the Console API.
- Console and Defenders.
- Console and the Prisma Cloud Intelligence Stream.
The following options control the properties of the certificates generated during the install process.
The default values for these options are typically adequate.
Note that these settings only change the values used when creating self-signed certificates.
Thus, users accessing the Console will still see warning messages because the certificates are not signed by a trusted certificate authority (CA).
To configure the Console to use a certificate signed by a trusted CA, follow the steps later in this article.
These options can be found in twistlock.cfg under the General Configuration section:
Configuration option | Description |
|---|---|
Specifies the Common Name to be used in the certificate generated by Prisma Cloud for the host that runs Console.
The Common Name is typically your host name plus domain name.
For example, it might be www.example.com or example.com. (Default) By default, the Common Name is assigned the output from the command hostname --fqdn. | |
Specifies the Common Name to be used in the certificate generated by Prisma Cloud for the hosts that run Defender. (Default) By default, the Common Name is assigned the output from the command hostname --fqdn. |
You can also control the Subject Alternative Names (SANs) in Console’s certificate.
Securing access to Console with custom certs
Secure access to Console with your own custom certs.
Prerequisites:
- Your certs have been generated by a commercial Certificate Authority (CA) or with your own Public Key Infrastructure (PKI). You should have the following files on hand:
- Make sure that the private key starts and ends with:----BEGIN PRIVATE KEY---- ----END PRIVATE KEY----or:-----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----Open Prisma Cloud Console in a browser.Navigate toManage > Authentication > System Certificates.Concatenate your public cert and private key into a single PEM file.$ cat server.crt server.key > server-cert.pemUpload the PEM file into theTLS Certificate for Consolesection.ClickSaveVerify that your certs have been correctly installed.Open your browser, and navigate to: https://<CONSOLE_HOSTNAME>:8083If you see the locked padlock icon, you have installed your certs correctly.
Most Popular
