Ensure valid certificate is set for browser-based administrator interface

보통레벨 2수동 검토paloalto

설명

In most cases, a browser HTTPS interface is used to administer the Palo Alto appliance. The certificate used to secure this session should satisfy the following criteria: 1. A valid certificate from a trusted source should be used. While a certificate from a trusted Public Certificate Authority is certainly valid, one from a trusted Private Certificate Authority is absolutely acceptable for this purpose. 2. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. 3. The certificate should use an acceptable cipher and encryption level.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify that the certificate used to secure HTTPS sessions meets the criteria by reviewing the appropriate certificate: Navigate to Device > Certificate Management > Certificates Verify that this Certificate is properly applied to the Management Interface: Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile

조치 방법

조치 방식: 가이드 또는 인프라 패치

Create or acquire a certificate that meets the stated criteria and set it: Navigate to Device > Certificate Management > Certificates Import an appropriate Certificate for your administrative session, from a trusted Certificate Authority. Navigate to Device > Certificate Management > SSL/TLS Service Profile Choose or import the certificate you want to use for the web based administrative session. Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile Choose the Service Profile that you have configured

속성

운영 체제: 모두
태그: paloaltoauthentication
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.2.5 Ensure valid certificate is set for browser-based administrator interface