Ensure that the Certificate used for Decryption is Trusted

ВисокаНиво 2Ручни прегледpaloalto

Опис

The CA Certificate used for in-line HTTP Man in the Middle should be trusted by target users. For SSL Forward Proxy configurations, there are classes of users that need to be considered. 1: Users that are members of the organization, users of machines under control of the organization. For these people and machines, ensure that the CA Certificate is in one of the Trusted CA certificate stores. This is easily done in Active Directory, using Group Policies for instance. A MDM (Mobile Device Manager) can be used to accomplish the same task for mobile devices such as telephones or tablets.

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Verify the CA Certificate(s): Navigate to Device > Certificate Management > Certificates Verify that appropriate internal certificates are imported, and that all certificates in the list are valid. In particular, verify the Subject, Issuer, CA, Expires, Algorithm and Usage fields Alternatively, if an internal CA is implemented on the firewall, verify that target clients have the root certificate for this CA imported into their list of trusted certificate authorities. (Full steps: CIS 8.3.)

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Set the CA Certificate(s): Navigate to Device > Certificate Management > Certificates. Import the appropriate CA Certificates from any internal Certificate Authorities. Alternatively, generate a self-signed certificate for an internal CA on the firewall, and then import the root certificate for that CA into the trusted CA list of target clients. In an Active Directory environment this can be facilitated using a Group Policy. Set the Certificate Profile needed for the SSL Forward Proxy: Navigate to Device > Certificate Management > Certificate Profile. Set the decryption profile to include the settings described in the SSL Forward Proxy guidance in this document

Својства

Оперативни системи: Било који
Ознаке: paloaltocrypto
Референца: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 8.3 Ensure that the Certificate used for Decryption is Trusted