https://community.checkpoint.com/t5/Firewall-and-Security-Management/Restrict-certificate-extensions/m-p/162763#M28960 <P>Hi CheckMates,</P><P>&nbsp;</P><P>Does Check Point support restriction of certificate extensions for https inspection? If yes how can we configure it?</P><P>&nbsp;</P><P><A href="https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-decryption-profile/settings-to-control-decrypted-ssl-traffic?adlt=strict" target="_blank" rel="noopener">Settings to Control Decrypted SSL Traffic (paloaltonetworks.com)</A></P><P>Restrict certificate extensions</P><UL><LI>Limits the certificate extensions used in the dynamic server certificate to key usage and extended key usage.</LI><LI>Restrict certificate extensions if your deployment requires no other certificate extensions.</LI></UL> Tue, 22 Nov 2022 12:39:15 GMT Saul_Goodman 2022-11-22T12:39:15Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Restrict-certificate-extensions/m-p/162763#M28960 <P>Hi CheckMates,</P><P>&nbsp;</P><P>Does Check Point support restriction of certificate extensions for https inspection? If yes how can we configure it?</P><P>&nbsp;</P><P><A href="https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-decryption-profile/settings-to-control-decrypted-ssl-traffic?adlt=strict" target="_blank" rel="noopener">Settings to Control Decrypted SSL Traffic (paloaltonetworks.com)</A></P><P>Restrict certificate extensions</P><UL><LI>Limits the certificate extensions used in the dynamic server certificate to key usage and extended key usage.</LI><LI>Restrict certificate extensions if your deployment requires no other certificate extensions.</LI></UL> Tue, 22 Nov 2022 12:39:15 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Restrict-certificate-extensions/m-p/162763#M28960 Saul_Goodman 2022-11-22T12:39:15Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Restrict-certificate-extensions/m-p/162821#M28982 <P>If it can be done anywhere, it would most likely be with the cipher_util utility on the gateway.<BR />Otherwise, I suspect it's an RFE.</P> Tue, 22 Nov 2022 17:19:06 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Restrict-certificate-extensions/m-p/162821#M28982 PhoneBoy 2022-11-22T17:19:06Z