Ensure that the Certificate used for Decryption is Trusted

AltaNível 2Revisão manualpaloalto

Descrição

The CA Certificate used for in-line HTTP Man in the Middle should be trusted by target users. For SSL Forward Proxy configurations, there are classes of users that need to be considered. 1: Users that are members of the organization, users of machines under control of the organization. For these people and machines, ensure that the CA Certificate is in one of the Trusted CA certificate stores. This is easily done in Active Directory, using Group Policies for instance. A MDM (Mobile Device Manager) can be used to accomplish the same task for mobile devices such as telephones or tablets.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Verify the CA Certificate(s): Navigate to Device > Certificate Management > Certificates Verify that appropriate internal certificates are imported, and that all certificates in the list are valid. In particular, verify the Subject, Issuer, CA, Expires, Algorithm and Usage fields Alternatively, if an internal CA is implemented on the firewall, verify that target clients have the root certificate for this CA imported into their list of trusted certificate authorities. (Full steps: CIS 8.3.)

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Set the CA Certificate(s): Navigate to Device > Certificate Management > Certificates. Import the appropriate CA Certificates from any internal Certificate Authorities. Alternatively, generate a self-signed certificate for an internal CA on the firewall, and then import the root certificate for that CA into the trusted CA list of target clients. In an Active Directory environment this can be facilitated using a Group Policy. Set the Certificate Profile needed for the SSL Forward Proxy: Navigate to Device > Certificate Management > Certificate Profile. Set the decryption profile to include the settings described in the SSL Forward Proxy guidance in this document

Propriedades

Sistemas operacionais: Qualquer
Tags: paloaltocrypto
Referência: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 8.3 Ensure that the Certificate used for Decryption is Trusted