Default self-signed certificate in PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM is delivering a default certificate self-signed, the question is why a self-signed certificate rather than one signed by a trusted CA.

Environment

PAM 4.2.x and up

Resolution

The self-signed certificate shipped with Symantec PAM is strictly intended to facilitate initial setup. It is not meant for production use. We do not embed a Certificate Authority (CA) signed SSL certificate in the default deployment for several reasons:

       - Trust Chain Integrity: A pre-packaged certificate would share the same private key across all customer installations. A             compromise at one customer site would risk the traffic security of all other deployments.

       - Expiration Lifespans: Public CA certificates expire after 200 days and will shorten to 47days by March 2029 (The                     CA/Browser Forum has officially mandated a phased reduction of public TLS certificate lifespans). Shipping a pre-                   signed certificate would cause the application to break out-of-the-box for future deployments once that hardcoded                   certificate expires.

        -Many corporate servers run in highly restricted, air-gapped, or proxy-isolated segments like a DMZ. These servers                 cannot freely reach the public internet to connect to a public Certificate Authority (CA) or its infrastructure.

To maintain proper security, the application must bind to your own trust chain during final deployment.  Many Organization run their own Internal CA. This benefits both cost and control over expiration timelines as well as algorithms (eg RSA or ECDSA or in future PQC)