GlobalProtect presents a certificate that is expired, expiring or self-signed
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
The GlobalProtect portal and gateway certificate is what a remote user's client checks before sending credentials. An expired certificate stops clients connecting; a self-signed one trains users to accept a certificate warning, which is the warning an attacker's portal would also produce.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Issue a certificate from a certificate authority the clients trust, import it, and select it in the portal's or gateway's SSL/TLS service profile.
- Renew ahead of the expiry date shown.
Command line
PAN-OS CLI, standalone firewall, vsys1
set vsys vsys1 ssl-tls-service-profile <profile-name> certificate <new-certificate-name>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show vsys vsys1 ssl-tls-service-profile <profile-name>Values to fill in2
- <profile-name>
- Which profile to change. A firewall carries several of each kind.
- <new-certificate-name>
- The name of the certificate you imported
Before you type it1
- No command renews a certificate. Import the new file, then point the profile at it.
How to confirm the fix
- Connect with a client and confirm no certificate warning is shown.
- Confirm the new certificate's validity dates in the certificate list.
Limits
- Expiry within 90 days of the assessment date is reported, the same window as PAN-SEC-048.
Compliance references
CIS Palo Alto Firewall 11 Benchmark v1.2.0
Covers part of the recommendation
Where a control aligns with a recommendation of the CIS Palo Alto Firewall 11 Benchmark v1.2.0, that recommendation is cited as a reference. Only that version was checked. A reference is not a certification.
More in Remote access VPN
- PAN-SEC-067GlobalProtect agent configuration saves user credentials
- PAN-SEC-068GlobalProtect gateway excludes the default route from the tunnel
- PAN-SEC-069GlobalProtect gateway is configured without a client certificate requirement
- PAN-SEC-112GlobalProtect accepts a TLS version below 1.2
- PAN-SEC-168Two agent tunnel profiles draw from the same or overlapping addresses
- PAN-SEC-169An agent tunnel profile matches any user beside other profiles
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.