In a Palo Alto Networks environment, GlobalProtect has been enabled using certificate-based authentication for both users and devices. To ensure proper validation of certificates, one or more…

Question

Options

• AThey store private keys for users and devices, effectively allowing the firewall to issue or reissue
• BThey define trust anchors (root / intermediate Certificate Authorities (CAs)), specify revocation
• CThey allow the firewall to bypass certificate validation entirely, focusing only on username /
• DThey provide a one-click mechanism to distribute certificates to all endpoints without relying on

• A
  4% (3)
• B
  93% (62)
• C
  1% (1)
• D
  1% (1)

Explanation

Certificate profiles in PAN-OS are configuration objects that tell the firewall HOW to validate certificates it receives during authentication. They define: (1) which root and intermediate CAs are trusted (trust anchors), (2) whether and how to check for revocation using CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol), and (3) fields to match on the certificate (e.g., subject). They do NOT store private keys - private keys are stored in the certificate/key store and never shared. They do not bypass validation (that would eliminate security), and they are not a certificate distribution mechanism. Certificate profiles are applied to interfaces, authentication profiles, and GP configurations to enforce proper PKI validation.

No community discussion yet for this question.