TMA-PALOALTO-1.2.5
Ensure valid certificate is set for browser-based administrator interface
Descrição
In most cases, a browser HTTPS interface is used to administer the Palo Alto appliance. The certificate used to secure this session should satisfy the following criteria: 1. A valid certificate from a trusted source should be used. While a certificate from a trusted Public Certificate Authority is certainly valid, one from a trusted Private Certificate Authority is absolutely acceptable for this purpose. 2. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. 3. The certificate should use an acceptable cipher and encryption level.
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
Verify that the certificate used to secure HTTPS sessions meets the criteria by reviewing the appropriate certificate: Navigate to Device > Certificate Management > Certificates Verify that this Certificate is properly applied to the Management Interface: Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Create or acquire a certificate that meets the stated criteria and set it: Navigate to Device > Certificate Management > Certificates Import an appropriate Certificate for your administrative session, from a trusted Certificate Authority. Navigate to Device > Certificate Management > SSL/TLS Service Profile Choose or import the certificate you want to use for the web based administrative session. Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile Choose the Service Profile that you have configured
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- paloaltoauthentication
- Referência
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.2.5 Ensure valid certificate is set for browser-based administrator interface