How to Import the Intermediate CA on the Firewall

Details

Palo Alto Networks firewall can block websites if they have untrusted certificates. Some websites use certificates signed by an intermediate CA. If an intermediate CA is not trusted on the Palo Alto Networks firewall, then it just drops the packets. To avoid this situation it is important to add an intermediate certificate on the firewall.

The firewall is configured to block SSL sites with untrusted certificates.

For example, the following site is signed by an intermediate certification, hence the firewall blocks it: www.studyisland.com

1. Download intermediate certificate "DigiCert SHA2 High Assurance Server CA" in PEM format.
   
    
2. Login to the firewall through the WebGUI
3. Go to Device > Certificates > Import > Import "Intermediate Cert"  "DigiCert SHA2 High Assurance Server CA"
   
4. Click on the certificate and check "Trusted Root CA".
   

owner: hshah