A certificate chain is a sequence of certificates where each certificate in the chain is signed by the subsequent certificate. This chain typically starts with the end-entity (or leaf) certificate and ends with a root certificate trusted by the firewall. The purpose of the certificate chain is to establish a path of trust from the end-entity certificate back to a trusted root certificate authority (CA).
Palo Alto Networks firewalls come preloaded with a set of trusted root CA certificates, known as the Default Trusted Certificate Authorities . These certificates are used to validate the authenticity of certificates presented during SSL/TLS handshakes. The list of default trusted CAs can be viewed and managed via the web interface:
Device > Certificate Management > Certificates > Default Trusted Certificate Authorities
It's important to note that intermediate CA certificates are not included by default and must be added manually if required.
If a certificate presented by a server is not trusted by the firewall (i.e., its issuing CA is not in the trusted list), you can manually add it:
Device > Certificate Management > Certificates
.
This process establishes trust for certificates issued by this CA.
During an SSL/TLS handshake, the server presents its certificate chain to the client (in this case, the firewall). The firewall then attempts to validate this chain by checking each certificate's signature up to a trusted root CA. If any certificate in the chain is missing or invalid, the validation fails.
It's crucial that the server provides a complete certificate chain, including all intermediate certificates. If intermediate certificates are missing, the firewall may not be able to validate the chain, even if the root CA is trusted.
To troubleshoot certificate validation issues, you can: