The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

An XCCDF Rule

Description

<VulnDiscussion>A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate. Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses. The Palo Alto Networks security platform can be configured to use Open Certificate Status Protocol (OCSP) and/or certificate revocation lists (CRLs) to verify the revocation status of certificates and the device itself can be configured as an OCSP responder.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-228841r557387_rule
Severity: Medium
References: CCI-000185
Updated: 17 days ago

To configure the Palo Alto Networks security platform to use an OCSP responder:
Go to Device >> Certificate Management >> OCSP Responder
Select "Add".
In the "OCSP Responder" window, enter the host name or IP address of the OCSP responder.

Note: If the firewall itself is configured as an OCSP responder, the host name must resolve to an IP address in the interface that the firewall uses for OCSP services.
To enable OCSP communication on the firewall:
Go to Device >> Setup >> Management
In the "Management Interface Settings" pane, select the "Edit" icon.
In the "Management Interface Settings" box, under "Services" check HTTP OCSP to enable it.
Select "OK"

Optionally, to configure the device itself as an OCSP responder, add an Interface Management Profile to the interface used for OCSP services.

Go to Network >> Network Profiles >> Interface Management
Select "Add" to create a new profile or click the name of an existing profile.
In the "Interface Management Profiles" window, under "Permitted Services", check HTTP OCSP.
Select "OK".

Go to Network >> Interfaces
Select the name of the interface that the firewall will use for OCSP services.

Note: When the  device itself as an OCSP responder, the OCSP Host Name must resolve to an IP address in this interface.

In the "Interface" window, under Other Info, in the "Management Profile" field, select the configured Management Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

Description

Remediation - Manual Procedure