Obtain a signed audit log client certificate for the Cloud-Delivered Firewall Management Center

Obtain a signed audit log client certificate for the Cloud-Delivered Firewall Management Center. This certificate enables secure communication between the appliance and the audit log server. It ensures that the server can authenticate audit log data and that the data is transmitted securely.

The system generates certificate request keys in Base-64 encoded PEM format.

Perform this task on the active appliance to generate a certificate signing request for audit log client authentication. Do not perform this task on a standby appliance in a high availability setup.

Before you begin

Keep this in mind:

  • To ensure security, use a globally recognized and trusted certificate authority (CA) to sign your certificate.

  • If you will require mutual authentication between the appliance and the audit log server, the same certificate authority must sign both the client certificate and the server certificate.

Follow these steps to obtain a signed audit log client certificate for the Cloud-Delivered Firewall Management Center:

Procedure

Step 1

Choose Administration > Configuration and click Audit Log Certificate.

Step 2

Click Generate New CSR.

Step 3

Enter a country code in the Country Name (two-letter code) field.

Step 4

Enter a state or province postal abbreviation in the State or Province field.

Step 5

Enter a Locality or City, an Organization name, and an Organizational Unit (Department) name.

Step 6

Enter the fully qualified domain name of the server for which you want to request a certificate in the Common Name field.

Note

If the common name and the DNS hostname do not match, audit log streaming will fail.

Step 7

Click Generate and then open a new blank file with a text editor.

Step 8

Copy the block of text from the certificate request, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines. Paste this information into a blank text file.

Step 9

Save the file as clientname.CSR. Replace clientname with the appliance name where you plan to use the certificate. Click Close.

After completing these steps, you will have a certificate signing request (CSR) file that can be submitted to a trusted certificate authority. After it is signed, you can import the certificate to the appliance for secure audit log streaming.

What to do next