Firewall setup · Palo Alto Networks

Certificate profile for Allowist feeds over HTTPS

PAN-OS checks the certificate of every External Dynamic List server it fetches over HTTPS against a certificate profile you attach to the EDL. This page gives you the profile for Allowist: which CA certificates to import, where to download them, and the clicks. Allow fifteen minutes.

Prefer not to manage a certificate profile at all? Each Allowist list can be served over plain HTTP instead (list settings → Protocol). Nothing to import on the firewall; the trade-off is that the list travels unencrypted, so keep the list's IP restriction on. Everything below is for the HTTPS feed.

What the firewall sees

Allowist's public certificate is issued by SSL.com and served through Cloudflare, so the chain your firewall receives is:

allowist.com                                  the server certificate (renews itself)
 └ Cloudflare TLS Issuing ECC CA n            sent by the server; "n" changes over time
    └ SSL.com TLS Transit ECC CA R2           sent by the server
       └ SSL.com TLS ECC Root CA 2022         trust anchor — in your profile
         (or AAA Certificate Services, when the cross-signed Transit CA is sent)

The RSA branch is the same with "RSA" in each name.

Whether you get the ECC or the RSA branch depends on the cipher suites your PAN-OS version offers, so the profile holds both. The Transit CA exists in two versions with the same key — one signed by the SSL.com 2022 root, one cross-signed by the older AAA Certificate Services root — and the edge may send either, so the profile holds that root too. With these five certificates the profile validates every chain Allowist can present, and it does not need to change when Cloudflare renews the server certificate or rotates its own issuing CA (the firewall receives those with every fetch).

Step 1 — download the five CA certificates

Straight from the certificate authorities. Save them on the workstation you use for the firewall's web interface.

Certificate (name it this on the firewall)	Download	SHA-256 fingerprint
SSL.com TLS RSA Root CA 2022	SSLcom-TLS-Root-2022-RSA.pem	8F AF 7D 2E 2C B4 70 9B B8 E0 B3 36 66 BF 75 A5 DD 45 B5 DE 48 0F 8E A8 D4 BF E6 BE BC 17 F2 ED
SSL.com TLS ECC Root CA 2022	SSLcom-TLS-Root-2022-ECC.pem	C3 2F FD 9F 46 F9 36 D1 6C 36 73 99 09 59 43 4B 9A D6 0A AF BB 9E 7C F3 36 54 F1 44 CC 1B A1 43
SSL.com TLS Transit RSA CA R2	SSL.com-TLS-T-RSA-R2.pem	FF E9 30 44 2D FE B6 9C E2 9A 90 8B 6A 63 9B 37 0B D6 BA 60 75 F9 31 AB 83 56 1D 93 8B 45 3A 21
SSL.com TLS Transit ECC CA R2	SSL.com-TLS-T-ECC-R2.pem	5D 1B C3 99 27 4E 64 9E 1C 72 69 7D E9 1A 54 AD 72 50 88 C5 22 1C B6 1E 17 EE 9C 29 0B C4 2A 92
AAA Certificate Services (Comodo / Sectigo root, valid to 2028)	Sectigo knowledge base → attachment AAACertificateServices	D7 A7 A0 FB 5D 7E 27 31 D7 71 E9 48 4E BC DE F7 1D 5F 0C 3E 0A 29 48 78 2B C8 3E E0 EA 69 9E F4

SSL.com's full repository, with the same files and fingerprints: ssl.com/repository; the AAA root is also in every operating system's trust store (Apple lists the same fingerprint). After importing, compare the fingerprint PAN-OS shows for each certificate with the table — if one differs, do not use it.

Step 2 — import them on the firewall

Device → Certificate Management → Certificates → Device Certificates → Import.
Certificate Name: the name from the table. Certificate File: the downloaded file. File Format: Base64 Encoded Certificate (PEM) for the .pem files; for the Sectigo file open it in a text editor first — if it starts with -----BEGIN CERTIFICATE----- it is PEM, otherwise import it as Binary Encoded Certificate (DER). Leave Import Private Key unchecked.
Repeat for all five. Each appears in the list with CA ticked.

On Panorama, import under Panorama → Certificate Management in the template the firewalls use.

Step 3 — create the certificate profile

Device → Certificate Management → Certificate Profile → Add.
Name: Allowist-EDL. Username Field: None. Domain: leave blank.
CA Certificates → Add: add the five certificates one by one. Leave Default OCSP URL and OCSP Verify CA Certificate empty.
Leave Use CRL and Use OCSP unchecked, and leave the three Block session… options unchecked — a revocation check that cannot be completed would otherwise stop the list from refreshing.
OK, then Commit.

Step 4 — attach it to the Allowist list

Objects → External Dynamic Lists → your Allowist list (or Add one: Type IP List, Source = the feed URL from Allowist's list settings, beginning https://allowist.com/t/…).
Certificate Profile: Allowist-EDL. Leave Client Authentication off unless you enabled feed Basic auth in Allowist.
Test Source URL must report success. If it fails with a certificate error, open Monitor → Logs → System and search for external-list: the message names the certificate PAN-OS could not verify.
OK, Commit. The firewall then refreshes the list on the interval set on the EDL (five minutes is the usual choice).

Check it from the CLI

request system external-list refresh type ip name <list name>
request system external-list show type ip name <list name>

The second command prints the addresses the firewall holds. From any computer with OpenSSL you can also see the chain Allowist is presenting right now:

openssl s_client -connect allowist.com:443 -servername allowist.com -showcerts </dev/null 2>/dev/null | grep -E "^ [0-9] s:|i:"

Common causes of "certificate validation failed"
• only the roots were imported and the edge sent the cross-signed Transit CA — add the AAA Certificate Services root (Step 1, last row);
• the ECC branch is missing — PAN-OS negotiated an ECDSA certificate; make sure both ECC certificates are in the profile;
• Block session if certificate status is unknown is on while CRL/OCSP is off — untick it;
• an older PAN-OS release with a stale clock — the SSL.com 2022 roots are valid from August 2022, so a firewall whose clock is wrong rejects them.

When this page changes

Allowist's server certificate renews itself about a month before expiry; nothing on the firewall changes. If SSL.com ever retires the Transit or Root CAs listed here, this page and the in-app note will say so well before the switch, and the new certificates will be added here first so a profile can hold both generations during the change. Questions: support.