topic Re: Generic Data Center HTTPS connection in Firewall and Security Management

Generic Data Center HTTPS connection

k_schekotoff — Mon, 05 Sep 2022 13:16:00 GMT

Hi All!

The Generic Data Center resource has certificate issued by 3rd party CA (internal CA). During connection procedure we need to approve certificate. The issue is the expiration time of the certificate is 4 days due to some internal reasons. Every 4 days the certificate expired and the Data Center is not available. New approval is needed after that. How we can avoid the situation with every 4 days approvals? May be we can add the CA to trusted or some how else?

Re: Generic Data Center HTTPS connection

cdav — Tue, 01 Apr 2025 07:54:25 GMT

Is anyone able to provide information here? I am looking to utilise generic data center object and the file would be hosted somewhere that would require TLS.

Re: Generic Data Center HTTPS connection

PhoneBoy — Tue, 01 Apr 2025 15:37:24 GMT

Have you tried adding the relevant CA to the trusted store?
This is configured with HTTPS Inspection, which has to be done in SmartDashboard prior to R82.
Otherwise, you'd have to ask TAC.

Re: Generic Data Center HTTPS connection

AaronCP — Tue, 01 Apr 2025 18:44:45 GMT

Hey @cdav,

I referenced this issue on this thread recently. It's operating as designed - if you were targeting a JSON file hosted on an external GitHub repo for your IP feed, if the certificate changes, you'd want to update the certificate to avoid any secuirty issues. As a result, the gateway will clear the object cache until you accept the new certificate, impacting traffic in the process.

This is a current concern of ours. We're starting to use more of these objects in our production firewall policies to enable application owners to automate traffic flows specific to their application. It's become crucial we track certificate expiry dates to avoid impact in production. I've got an open SR with our Diamond Engineer to investigate possible workarounds to this issue. I'll update this thread if I get anywhere with it!

Re: Generic Data Center HTTPS connection

cdav — Tue, 01 Apr 2025 21:16:43 GMT

Hi @AaronCP this is exactly what I was after as I hadn't yet spent any time investigating myself so thank you.