The Palo Alto Networks security platform must use DoD-approved PKI rather than proprietary or self-signed device certificates.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-228674 | SRG-APP-000516-NDM-000344 | PANW-NM-000141 | SV-228674r961863_rule | 2025-03-12 | 3 |
| Description |
|---|
| DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling mandates that certificates must be issued by the DoD PKI or by a DoD-approved PKI for authentication, digital signature, or encryption. |
| ℹ️ Check |
|---|
| Go to Device >> Certificate Management >> Certificates Installed Certificates are listed in the "Device Certificates" tab. If any of the have the name or identifier of a non-approved source in the "Issuer" field, this is a finding. |
| ✔️ Fix |
|---|
| Obtain a Device Certificate from the DoD PKI or from a DoD-approved PKI: Go to Device >> Certificate Management >> Certificates Select "Import" (at the bottom of the pane). In the "Import Certificate" pane, complete each field. Select "OK". |