Ensure that the Certificate used for Decryption is Trusted

높음레벨 2수동 검토paloalto

설명

The CA Certificate used for in-line HTTP Man in the Middle should be trusted by target users. For SSL Forward Proxy configurations, there are classes of users that need to be considered. 1: Users that are members of the organization, users of machines under control of the organization. For these people and machines, ensure that the CA Certificate is in one of the Trusted CA certificate stores. This is easily done in Active Directory, using Group Policies for instance. A MDM (Mobile Device Manager) can be used to accomplish the same task for mobile devices such as telephones or tablets.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify the CA Certificate(s): Navigate to Device > Certificate Management > Certificates Verify that appropriate internal certificates are imported, and that all certificates in the list are valid. In particular, verify the Subject, Issuer, CA, Expires, Algorithm and Usage fields Alternatively, if an internal CA is implemented on the firewall, verify that target clients have the root certificate for this CA imported into their list of trusted certificate authorities. (Full steps: CIS 8.3.)

조치 방법

조치 방식: 가이드 또는 인프라 패치

Set the CA Certificate(s): Navigate to Device > Certificate Management > Certificates. Import the appropriate CA Certificates from any internal Certificate Authorities. Alternatively, generate a self-signed certificate for an internal CA on the firewall, and then import the root certificate for that CA into the trusted CA list of target clients. In an Active Directory environment this can be facilitated using a Group Policy. Set the Certificate Profile needed for the SSL Forward Proxy: Navigate to Device > Certificate Management > Certificate Profile. Set the decryption profile to include the settings described in the SSL Forward Proxy guidance in this document

속성

운영 체제: 모두
태그: paloaltocrypto
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 8.3 Ensure that the Certificate used for Decryption is Trusted