Palo Alto Networks
TMA-PALOALTO-1.2.5
Ensure valid certificate is set for browser-based administrator interface
Description
In most cases, a browser HTTPS interface is used to administer the Palo Alto appliance. The certificate used to secure this session should satisfy the following criteria: 1. A valid certificate from a trusted source should be used. While a certificate from a trusted Public Certificate Authority is certainly valid, one from a trusted Private Certificate Authority is absolutely acceptable for this purpose. 2. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. 3. The certificate should use an acceptable cipher and encryption level.
Méthode de vérification
Méthode d'audit: Revue manuelle
Verify that the certificate used to secure HTTPS sessions meets the criteria by reviewing the appropriate certificate: Navigate to Device > Certificate Management > Certificates Verify that this Certificate is properly applied to the Management Interface: Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Create or acquire a certificate that meets the stated criteria and set it: Navigate to Device > Certificate Management > Certificates Import an appropriate Certificate for your administrative session, from a trusted Certificate Authority. Navigate to Device > Certificate Management > SSL/TLS Service Profile Choose or import the certificate you want to use for the web based administrative session. Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile Choose the Service Profile that you have configured
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- paloaltoauthentication
- Référence
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.2.5 Ensure valid certificate is set for browser-based administrator interface