The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62777	PANW-NM-000141	SV-77267r1_rule		Medium

Description
DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling mandates that certificates must be issued by the DoD PKI or by a DoD-approved PKI for authentication, digital signature, or encryption.

STIG	Date
Palo Alto Networks NDM Security Technical Implementation Guide	2019-12-20

Details

Check Text ( C-63585r1_chk )
Go to Device >> Certificate Management >> Certificates Installed Certificates are listed in the "Device Certificates" tab. If any of the have the name or identifier of a non-approved source in the "Issuer" field, this is a finding.

Fix Text (F-68697r1_fix)
Obtain a Device Certificate from the DoD PKI or from a DoD-approved PKI: Go to Device >> Certificate Management >> Certificates Select "Import" (at the bottom of the pane). In the "Import Certificate" pane, complete each field. Select "OK".