Configure a Certificate Profile

1. Obtain the certificate authority (CA) certificates you will assign to the profile.
   Assign at least one certificate to a certificate profile. Choose one of the following options to obtain the CA certificates you will assign to the profile.

   • Generate a certificate.
   • Export a certificate from your enterprise CA, then import it onto the firewall (refer to step 3.2).
2. Identify the certificate profile.
   1. Select DeviceCertificate ManagementCertificate Profile, and then Add a profile.
   2. Enter a Name to identify the profile.
      The name is case-sensitive, must be unique, and can use up to 63 characters on the firewall or up to 31 characters on Panorama. Only letters, numbers, spaces, hyphens, and underscores are allowed.
   3. If the firewall has more than one virtual system (vsys), select a Location (vsys or Shared) for the certificate.
3. Assign one or more certificates to the profile.
   Repeat the following steps for each CA certificate:
   1. In the CA Certificates table, click Add.
   2. Select a CA Certificate.
      Alternatively, you can Import a certificate. To import a certificate, enter a Certificate Name, Browse for a Certificate File you exported from an enterprise CA, and then click OK.
   3. (Optional) If the firewall uses OCSP to verify certificate revocation status, configure the following fields to override the default behavior. For most deployments, these fields do not apply.
      • By default, the firewall uses the Authority Information Access (AIA) information from the certificate to extract the OCSP responder information. To override the AIA information, enter a Default OCSP URL (starting with http:// or https://).
      • By default, the firewall uses the certificate selected in the CA Certificate field to validate OCSP responses. To use a different certificate for validation, select it in the OCSP Verify CA Certificate field.
   4. Click OK. The CA Certificates table displays the assigned certificate.
4. Define the methods for verifying certificate revocation status and the associated blocking behavior.
   1. Select Use CRL or Use OCSP. If you select both, the firewall first tries OCSP and falls back to the CRL method only if the OCSP responder is unavailable.
   2. Depending on the verification method, specify a CRL Receive Timeout or OCSP Receive Timeout value in seconds (range is 1 to 60).
      After these intervals, the firewall stops waiting for a response from the CRL or OCSP service.
   3. Specify a Certificate Status Timeout in seconds (range is 1 to 60).
      After this interval, the firewall stops waiting for a response from either certificate status service and applies any session-blocking logic you define. The Certificate Status Timeout relates to the OCSP or CRL Receive Timeout setting as follows:

      • If you enable both OCSP and CRL, the firewall registers a request timeout after the lesser of two intervals passes: the Certificate Status Timeout value or the aggregate of the two Receive Timeout values.
      • If you enable only OCSP, the firewall registers a request timeout after the lesser of two intervals passes: the Certificate Status Timeout value or the OCSP Receive Timeout value.
      • If you enable only CRL, the firewall registers a request timeout after the lesser of two intervals passes: the Certificate Status Timeout value or the CRL Receive Timeout value.
   4. Block sessions if certificate status is unknown.
      If you select this option, the firewall blocks sessions when the OCSP or CRL service returns a certificate revocation status of unknown. Otherwise, the firewall allows these sessions.
   5. Block sessions if certificate status cannot be retrieved within timeout.
      If you select this option, the firewall blocks sessions after the firewall registers the timeout of an OCSP or CRL request. Otherwise, the firewall allows these sessions.
   6. (GlobalProtect only) Block sessions if the certificate was not issued to the authenticating device.
      If you select this option, the firewall blocks sessions when the serial number attribute in the subject of the client certificate does not match the host ID that the GlobalProtect app reports for the endpoint.
   7. Block sessions with expired certificates.
5. Click OK, then Commit your changes.