Skip to content

Preload Trusted CA Intermediate Certificate Chains on PAN-OS

License

Notifications You must be signed in to change notification settings

ghas-results/pan-chainguard

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

41 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

pan-chainguard - Preload Trusted CA Intermediate Certificate Chains on PAN-OS

pan-chainguard is a Python3 application which uses CCADB data to derive intermediate certificate chains for trusted certificate authorities in PAN-OS so they can be preloaded as device certificates.

Problem

Many TLS enabled origin servers suffer from a misconfiguration in which they:

  1. Do not return intermediate CA certificates.
  2. Return certificates out of order.
  3. Return intermediate certificates which are not related to the CA which signed the server certificate.

The impact for PAN-OS SSL decryption administrators is end users will see errors such as unable to get local issuer certificate until the sites that are misconfigured are identified, the required intermediate certificates are obtained, and the certificates are imported into PAN-OS.

Solution: Intermediate CA Preloading

pan-chainguard uses the PAN-OS default trusted CA store and the All Certificate Information (root and intermediate) in CCADB (CSV) data file as input, and determines the intermediate certificate chains, if available, for each root CA certificate. These can then be added to PAN-OS as trusted CA device certificates.

By preloading known intermediates for the trusted CAs, the number of TLS connection errors that users encounter for misconfigured servers can be reduced, without reactive actions by an administrator.

Documentation

Install pan-chainguard

pan-chainguard is available as a release on GitHub and as a package on PyPi.

About

Preload Trusted CA Intermediate Certificate Chains on PAN-OS

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • Python 98.8%
  • Shell 1.2%