Ensure that the Certificate Securing Remote Access VPNs is Valid

OrtaDüzey 2Manuel incelemepaloalto

Açıklama

The Certificate used to secure Remote Access VPNs should satisfy the following criteria: It should be a valid certificate from a trusted source. In almost cases this means a trusted Public Certificate Authority, as in most cases remote access VPN users will not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

Verify that the certificate being used to secure the VPN meets the criteria listed above: Navigate to Device > Certificate Management > Certificates Ensure that a valid certificate is applied to the HTTPS portal: Navigate to Network > GlobalProtect > Portals > Portal Configuration > (Select the Portal being assessed) > Authentication > SSL/TLS Profile Ensure that a valid certificate is applied to the GlobalProtect Gateway: Navigate to Network > GlobalProtect > Gateways > (Select the Gateway being Assessed) > Authentication > SSL/TLS Service Profile Ensure that ... (Full steps: CIS 1.6.3.)

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Create a CSR and install a certificate from a public CA (Certificate Authority) here: Navigate to Device > Certificate Management > Certificates Apply a valid certificate to the HTTPS portal: Navigate to Network > GlobalProtect > Portals > Portal Configuration > Authentication > SSL/TLS Profile Apply a valid certificate to the GlobalProtect Gateway: Navigate to Network > GlobalProtect > Gateways > Authentication > SSL/TLS Service Profile Configure the Service Profile to use the correct certificate Ensure that the Minimum TLS version is set to 1.1 or 1.2 (1.2 is recommended).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: paloaltocrypto
Referans: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.6.3 Ensure that the Certificate Securing Remote Access VPNs is Valid