>
    Configure Certificate-Based Administrator Authentication to the Web Interface
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Firewall Administration
    4. Manage Firewall Administrators
    5. Configure Administrative Accounts and Authentication
    6. Configure Certificate-Based Administrator Authentication to the Web Interface
    Download PDF

    Configure Certificate-Based Administrator Authentication to the Web Interface

    Table of Contents
    End-of-Life (EoL)

    Configure Certificate-Based Administrator Authentication to the Web Interface

    As a more secure alternative to password-based authentication to the firewall web interface, you can configure certificate-based authentication for administrator accounts that are local to the firewall. Certificate-based authentication involves the exchange and verification of a digital signature instead of a password.
    Configuring certificate-based authentication for any administrator disables the username/password logins for all administrators on the firewall; administrators thereafter require the certificate to log in.
    1. Generate a certificate authority (CA) certificate on the firewall.
      You will use this CA certificate to sign the client certificate of each administrator.
      Create a Self-Signed Root CA Certificate.
      Alternatively, Import a Certificate and Private Key from your enterprise CA or a third-party CA.
    2. Configure a certificate profile for securing access to the web interface.
      Configure a Certificate Profile.
      • Set the Username Field to Subject.
      • In the CA Certificates section, Add the CA Certificate you just created or imported.
    3. Configure the firewall to use the certificate profile for authenticating administrators.
      1. Select DeviceSetupManagement and edit the Authentication Settings.
      2. Select the Certificate Profile you created for authenticating administrators and click OK.
    4. Configure the administrator accounts to use client certificate authentication.
      For each administrator who will access the firewall web interface, Configure a Firewall Administrator Account and select Use only client certificate authentication.
      If you have already deployed client certificates that your enterprise CA generated, skip to Step 8. Otherwise, go to Step 5.
    5. Generate a client certificate for each administrator.
      Generate a Certificate. In the Signed By drop-down, select a self-signed root CA certificate.
    6. Export the client certificate.
      1. Export a Certificate and Private Key.
      2. Commit your changes. The firewall restarts and terminates your login session. Thereafter, administrators can access the web interface only from client systems that have the client certificate you generated.
    7. Import the client certificate into the client system of each administrator who will access the web interface.
      Refer to your web browser documentation.
    8. Verify that administrators can access the web interface.
      1. Open the firewall IP address in a browser on the computer that has the client certificate.
      2. When prompted, select the certificate you imported and click OK. The browser displays a certificate warning.
      3. Add the certificate to the browser exception list.
      4. Click Login. The web interface should appear without prompting you for a username or password.

    © 2024 Palo Alto Networks, Inc. All rights reserved.