InformationIn most cases, a browser HTTPS interface is used to administer the Palo Alto appliance. The certificate used to secure this session should satisfy the following criteria:
A valid certificate from a trusted source should be used. While a certificate from a trusted Public Certificate Authority is certainly valid, one from a trusted Private Certificate Authority is absolutely acceptable for this purpose.
The certificate should have a valid date. It should not have a 'to' date in the past (it should not be expired), and should not have a 'from' date in the future.
The certificate should use an acceptable cipher and encryption level.
If a certificate that is self-signed, expired, or otherwise invalid is used for the browser HTTPS interface, administrators in most cases will not be able to tell if their session is being eavesdropped on or injected into by a 'Man in the Middle' attack.
If the default self-signed certificate is used, an administrator will not be able to clearly tell if their HTTPS session is being hijacked or not. Using a trusted certificate ensures that the session is both encrypted and trusted.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
SolutionCreate or acquire a certificate that meets the stated criteria and set it:
Navigate to Device > Certificate Management > Certificates
Import an appropriate Certificate for your administrative session, from a trusted Certificate Authority.
Navigate to Device > Certificate Management > SSL/TLS Service Profile
Choose or import the certificate you want to use for the web based administrative session.
Navigate to Device > Setup > Management > General Settings > SSL/TLS Service Profile
Choose the Service Profile that you have configured
A self-signed certificate is installed by default for the administrative interface.
Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT
References: 800-53|AC-18, 800-53|AC-18(1), 800-53|AC-18(3), 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, CSCv7|14.4, CSCv7|16.5
Control ID: 0d5b2c890fa7a1a3d21b46e56d9adfaafb99a8dee00baf32766f1fb809d34a00