Import 2 Different Domain CA for outbound HTTPS inspection certificates

[KeonNg]

Hi All,

Current Environment Setup:

URL Filtering Enabled

HTTPS Inspection Enabled: Domain A (Signed by Third-Party CA) 

There's scenario when customer is migrating to new active directory domains, so there would some existing users still in Domain A however some users is migrated to Domain B. Previously all the user's PC is already installed the certificate under domain A that export from the gateway for HTTPs Inspection. However, when migrating the users to new domain, those new users' domain is facing certificate authority invalid issue which cause them unable to browse internet. After checked found that the browser certificate is still using old domain A, that's why the connection is not trusted as different domain. 

Customer concern if renew the HTTPs Inspection certificate to new Domain B, all the existing users that still in Domain A might have impact where's the gateway will not recognize for these users. However, if without renew the cert to new domain, those migrated users is impacted, and they couldn't browser internet. 

Hence would like to know whether is that possible to import 2 different domain CA cert to the HTTPs Inspection as so the HTTPs Inspection can be applicable to two different Activity Directory domain users. Or is there any workaround for this situation? Kindly please advised. Thank you. 

Best Regards,
Keon

[emmap]

I believe it's a planned feature for R82 to support multiple outbound HTTPS certificates.

If you can't wait for that, you will have to look at (for example) deploying the domain B cert out to the domain A PCs as a trusted CA, and then importing that CA into the gateways. You could do it the other way around but then you have to maintain that for every new domain B PC. 

[KeonNg]

Hi emmap,

The example you mentioned is that means that we are taking the domain B cert to domain A to acknowledge as trusted CA and import to the gateway, so we have to renew the certificate, and export it out and install at all domain B PCs? Sorry that I'm not so familiar to the CA signed certificate flow. 

By doing this will not interrupt existing users to install again the latest certificate once renewed?

Best Regards,

Keon

[emmap]

If you're using the domain B CA cert, all the domain B PCs trust it already. That's the benefit of using your AD CA cert for HTTPS inspection. There's no cert renewing happening.

[PhoneBoy]

Yes, this functionality (allowing multiple outbound CAs for HTTPS Inspection) is in the R82 Public EA:

[Spiky]

hi Phoneboy  

is there any way to  tell servers/or a subnet which Outbound cert to use?

using your screen shot

Server A use outbound TestCA1

Server B use outbound TestCA2

or  does server A use Testca1, but if server two doesnt have Testca1 but has TestCa2 it will work as its got the cert?

[PhoneBoy · Accepted solution]

The CA key is configured per gateway:

Prior to R82, you could only use a CA key per management domain (affects all managed firewalls).

[Spiky]

ah thank you, much appreciated