Panorama cert replacement via API. (lemmy.world)

submitted 1 year ago by keefshape@lemmy.world to c/techsupport@lemmy.world

5 comments fedilink hide all child comments

So I have had this script I have been working on for a while, intended to automate LetsEncrypt renewals and deploy those certs to Panorama for Palo Alto endpoints.

I have had some success by brute-forcing the process. Delete pubkey and privkey, then replace. This is problematic if any of those certs are being used in objects though.

Is there an API mechanism anyone is aware of, XML or REST, than can be used to replace a cert currently being utilized in objects?

Or is the mechanism really only to deploy to a whole new entry, and switch the SSL profile to that new one? That's the only other path forward I can currently see, and it feels like extra work.

you are viewing a single comment's thread
view the rest of the comments

[-] keefshape@lemmy.world 2 points 1 year ago

Oh shit, first set of examples for the REST docs shows importing s combined keypair! That would solve the keypair mismatch when importing one at a time.

Solid! 👊

[-] jemikwa@lemmy.blahaj.zone 2 points 1 year ago* (last edited 1 year ago)

Makes sense, you can do the same with the GUI if you import it as an encrypted .pem with the public and private key in the same file.

this post was submitted on 14 Oct 2023

5 points (85.7% liked)

techsupport

2469 readers

5 users here now

The Lemmy community will help you with your tech problems and questions about anything here. Do not be shy, we will try to help you.

If something works or if you find a solution to your problem let us know it will be greatly apreciated.

Rules: instance rules + stay on topic

Partnered communities:

You Should Know

Software gore

Recommendations

founded 1 year ago

MODERATORS

GatoB@lemmy.world