To establish a secure TLS connection with the Strata Logging Service, the Next-Generation Firewall (NGFW) must validate the server certificate presented by the service. This validation process relies on a chain of trust. The NGFW must have the appropriate Root Certificate Authority (CA) certificate in its trust store. This Root CA certificate serves as the ultimate trust anchor, allowing the firewall to verify the entire certificate chain presented by the Strata Logging Service and confirm its identity. Without the correct Root CA certificate, the firewall cannot establish trust and the connection will fail.

A. Device: A device certificate is used to identify the firewall itself, not to validate the identity of the remote Strata Logging Service.

B. Server: The server certificate is presented by the Strata Logging Service during the TLS handshake; it is not a prerequisite on the NGFW.

D. Intermediate CA: While an Intermediate CA certificate is part of the validation chain, the Root CA is the fundamental trust anchor required for the entire process.

1. Palo Alto Networks. (2023). Strata Logging Service Administrator's Guide. "Secure the Connection to Strata Logging Service". The documentation states, "To secure the connection between your firewall and the Strata Logging Service, the firewall must have the appropriate root certificate authority (CA) certificates to validate the Strata Logging Service certificate."

2. Palo Alto Networks. (2023). PAN-OS® 11.0 Administrator’s Guide. "Certificate Management". This guide explains the role of certificates, stating, "A CA certificate is a digital certificate that is issued by a certificate authority (CA) that you trust. The firewall uses CA certificates to validate certificates that are presented to it for authentication... The firewall uses root CA certificates to build a chain of trust." This principle is directly applicable to connecting to any trusted cloud service.