Preload Trusted CA Intermediate Certificate Chains on PAN-OS
Project description
pan-chainguard is a Python3 application which uses CCADB data to derive intermediate certificate chains for trusted certificate authorities in PAN-OS so they can be preloaded as device certificates.
Problem
Many TLS enabled origin servers suffer from a misconfiguration in which they:
Do not return intermediate CA certificates.
Return certificates out of order.
Return intermediate certificates which are not related to the CA which signed the server certificate.
The impact for PAN-OS SSL decryption administrators is end users will see errors such as unable to get local issuer certificate until the sites that are misconfigured are identified, the required intermediate certificates are obtained, and the certificates are imported into PAN-OS.
Solution: Intermediate CA Preloading
pan-chainguard uses the PAN-OS default trusted CA store and the All Certificate Information (root and intermediate) in CCADB (CSV) data file as input, and determines the intermediate certificate chains, if available, for each root CA certificate. These can then be added to PAN-OS as trusted CA device certificates.
By preloading known intermediates for the trusted CAs, the number of TLS connection errors that users encounter for misconfigured servers can be reduced, without reactive actions by an administrator.
Documentation
Administrator’s Guide:
https://github.com/PaloAltoNetworks/pan-chainguard/blob/main/doc/admin-guide.rst
Install pan-chainguard
pan-chainguard is available as a release on GitHub and as a package on PyPi.
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for pan_chainguard-0.2.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 339546b6f8fed5c7c2889a9db68c0ac532adf9100e9c79d914859eff66ca6f70 |
|
MD5 | ed260fb96bca8104270fdf4ac2975999 |
|
BLAKE2b-256 | 5b6359ce4ae7acd0df21192b9ce626710ccb54b0c8be80a4cd9877da8f15e95d |