Unable to Set Certificate as Forward Trust Certificate
25025
Created On 07/16/19 19:15 PM - Last Modified 10/21/20 03:08 AM
Question
Why is the option to "Set a Certificate as a Forward Trust Certificate" greyed out?
Environment
Any current PAN-OS version
Answer
The certificate will be used to generate a certificate in reference to the trusted websites' certificates.
Therefore, in order to use a certificate as a Forward Trust Certificate, we need to have the below requirements met:
1. The certificate should include its private key on the PA Firewall.
2. The "Key Usage" field should contain "Certificate Sign".
Additional Information
NOTE:
One of the ways of checking a certificate's details is using OpenSSL command below:
openssl x509 -in certificate.crt -text -noout