PANW-AG-000044 - The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

Information

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.

Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

The Palo Alto Networks security platform can be configured to use Open Certificate Status Protocol (OCSP) and/or certificate revocation lists (CRLs) to verify the revocation status of certificates and the device itself can be configured as an OCSP responder.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To configure the Palo Alto Networks security platform to use an OCSP responder:
Go to Device >> Certificate Management >> OCSP Responder
Select 'Add'.
In the 'OCSP Responder' window, enter the host name or IP address of the OCSP responder.

Note: If the firewall itself is configured as an OCSP responder, the host name must resolve to an IP address in the interface that the firewall uses for OCSP services.

To enable OCSP communication on the firewall:
Go to Device >> Setup >> Management
In the 'Management Interface Settings' pane, select the 'Edit' icon.
In the 'Management Interface Settings' box, under 'Services' check HTTP OCSP to enable it.
Select 'OK'

Optionally, to configure the device itself as an OCSP responder, add an Interface Management Profile to the interface used for OCSP services.

Go to Network >> Network Profiles >> Interface Management
Select 'Add' to create a new profile or click the name of an existing profile.
In the 'Interface Management Profiles' window, under 'Permitted Services', check HTTP OCSP.
Select 'OK'.

Go to Network >> Interfaces
Select the name of the interface that the firewall will use for OCSP services.

Note: When the device itself as an OCSP responder, the OCSP Host Name must resolve to an IP address in this interface.

In the 'Interface' window, under Other Info, in the 'Management Profile' field, select the configured Management Profile.
Select 'OK'.
Commit changes by selecting 'Commit' in the upper-right corner of the screen.
Select 'OK' when the confirmation dialog appears.

Item Details

Audit Name: DISA STIG Palo Alto ALG v3r1

Category: IDENTIFICATION AND AUTHENTICATION

Plugin: Palo_Alto

Control ID: 23ed1c92459d979bfa0b404cd49ab8521ce5268a30bcc7bc359b43613f8e04a0

Detections

Analytics

PANW-AG-000044 - The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

Information

Solution

See Also

Item Details