Prisma Cloud Compute certificates

This article summarizes all the certificates used by Prisma Cloud Compute. For each certificate, you can learn more about its functionallity, signing CA, and your customization options.
Customizing certificates is only allowed for Prisma Cloud Compute edition.
Category
Certificate
Communication
Certificate customization
Default CA
CA customization
Prisma Cloud edition
Console TLS communication
Console Web and API certificate
Web browser, API and twistcli access to console
Customize under
Manage > Authentication > System certificates > TLS certificate for Console > Concatenate public cert and private key
Console CA
Your organization CA
Compute edition, Enterprise edition
Client certificates
To enforce Docker access control, client certs should be installed on any host where the docker client can be run.
Clients (users) access to remote Docker Engine instances
Customize your own certificates for your clients
Explicit list of trusted certificates can be defined under
Manage > Authentication > System certificates > Client certificates > Explicit certificate trust list
Console CA
Customize under
Manage > Authentication > System certificates > Client certificates > CA certificate
Compute edition, Enterprise edition
Certificate-based authentication to Console
Clients access the Console
No CA by default
Enable Console verification of the client’s CA certificate when accessing the Console.
Define CA under
Manage > Authentication > System certificates > Certificate-based authentication to Console > CA certificate
Compute edition
Console-Defender communication
Defender server certificate (Console side)
Console-Defender communication
Yes, for Compute Edition only.
See here
Defender CA (defender-ca.pem)
Yes, for Compute Edition only.
See here
Compute edition only. Not relevant for Enterprise edition (uses API token)
Console-Defender communication
Defender client certificate (Defender side)
Console-Defender communication
No
Defender CA (defender-ca.pem)
No
Compute edition, not relevant for Enterprise edition (uses API token)
Admission certificate (admission-cert.pem)
Admission webhook authentication with Prisma Cloud Defender
No
Defender CA (defender-ca.pem)
No
Compute edition, Enterprise edition

Console TLS communication certificates

You can secure access to Console with your own digital certificate. By default, Prisma Cloud accesses the Console’s web portal and API with a self-signed certificate.
The self-managed certificate generated by Console is valid for three years. 90 days prior to expiration, Prisma Cloud will let you rotate it (a banner will appear at the top of the UI). After rotating Console’s certificate, you must restart the Console.
When you access Console’s web portal with this setup, for example, the browser flags the portal as untrusted with a warning message. The following screenshot shows the warning message in Chrome:
You can resolve these warnings by installing your own certificate that proves your server’s identity to the client. With the proper certificate, users are taken directly to Console, and the green padlock in the address bar indicates that the site is trusted.
Creating certificates is outside the scope of this article. For more information about how SSL and certificates secure a site, see How does HTTPS actually work.

Configuration options

Prisma Cloud secures the communication between various actors and entities with certificates. These certificates are automatically generated and self-signed during the Prisma Cloud install process. They secure communication between:
  • Users and the Console web portal
  • Users and the Console API
  • Console and the Prisma Cloud Intelligence Stream
The following options control the properties of the certificates generated during the install process. The default values for these options are typically adequate.
Note that these settings only change the values used when creating self-signed certificates. Thus, users accessing the Console will still see warning messages because the certificates are not signed by a trusted certificate authority (CA). To configure the Console to use a certificate signed by a trusted CA, follow the steps later in this article.
These options can be found in twistlock.cfg under the General Configuration section:
Configuration option
Description
Specifies the Common Name to be used in the certificate generated by Prisma Cloud for the host that runs Console. The Common Name is typically your host name plus domain name. For example, it might be www.example.com or example.com.
(Default) By default, the Common Name is assigned the output from the command hostname --fqdn.
Specifies the Common Name to be used in the certificate generated by Prisma Cloud for the hosts that run Defender.
(Default) By default, the Common Name is assigned the output from the command hostname --fqdn.
You can also control the Subject Alternative Names (SANs) in Console’s certificate.

Securing access to Console with custom certificates

Secure access to Console with your own custom certificates.
Prerequisites:
  • Your certs have been generated by a commercial Certificate Authority (CA) or with your own Public Key Infrastructure (PKI). You should have the following files on hand:
    • A .pem file, which contains your certificate and your Certificate Authority’s intermediate certificates.
    • A .key file, which contains your private key.
  1. Have your signed certificate (.pem file) and private key (.key file) ready to be accessed and uploaded to Console.
    Make sure that the private key starts and ends with:
    ----BEGIN PRIVATE KEY---- ----END PRIVATE KEY----
    or:
    -----BEGIN RSA PRIVATE KEY----- -----END RSA PRIVATE KEY-----
  2. Open Prisma Cloud Console in a browser.
  3. Navigate to
    Manage > Authentication > System Certificates
    .
  4. Concatenate your public certificate and private key into a single PEM file.
    $ cat server.crt server.key > server-cert.pem
  5. Open the
    TLS certificate for Console
    section
    1. Upload the PEM file into the