Skip to content

Palo Alto Networks Panorama

  1. In the Certificate Manager - SaaS toolbar, click Machines.
  2. Click the more options more options button at the right end of the Panorama machine's row, and then select Provision.

  3. From the Search a certificate by name, expiration, or fingerprint field, begin typing the certificate name you want to provision. Click the certificate when it appears in the list.

    Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.

  4. In the Certificate Name field, enter the name for this certificate as you want it to appear on your Panorama.

    What if the name is already in use on the Panorama?

    When provisioning a certificate to the Panorama, Certificate Manager - SaaS checks whether the name you enter in this field is already in use in the selected template and location.

    • If the name isn't in use, Certificate Manager - SaaS will use it.
    • If the name is in use by the same certificate, Certificate Manager - SaaS reuses the existing certificate instead of importing it again.
    • If the name is in use by a different certificate, Certificate Manager - SaaS generates a unique name from the certificate's common name, expiration date, and serial number.

  5. (Optional) In the Template field, enter the template or template stack that will store the certificate. The certificate is pushed to the devices that use this template or template stack. Leave the field empty to store the certificate in Panorama's own configuration.

  6. (Optional) In the Location field, enter the virtual system (vsys) of the template that will store the certificate, for example vsys1. Leave the field empty to store the certificate in the template's Shared location.

    The Location field is ignored in these cases:

    • Template is empty. The certificate is stored in Panorama's own configuration, which has no vsys.
    • Template names a template stack. The certificate is stored in the template stack's Shared location.

  7. From the Certificate Binding Target Type drop-down, select what the certificate will be bound to. A selection is required:

    • No binding - Import the certificate without binding it.
    • SSL/TLS Service Profile - Bind the certificate to an SSL/TLS Service Profile, for example one used by a GlobalProtect portal or gateway, or by the management interface.
    • Decryption Policy Rule - Add the certificate to an SSL Inbound Inspection Decryption Policy Rule. Requires a Template.

  8. Configure the binding target as described in Binding targets. Certificate Binding Target Name is required for SSL/TLS Service Profile and Decryption Policy Rule. The other fields depend on the type:

    • SSL/TLS Service Profile shows SSL/TLS Service Profile Location.
    • Decryption Policy Rule shows Device Group and Replace Certificate.

    With No binding, leave Certificate Binding Target Name empty. Provisioning fails if a name is set.

    Installations with an empty binding target type

    Installations created or discovered before Certificate Binding Target Type was required can have it empty. They keep working: with Certificate Binding Target Name set, the name is treated as an SSL/TLS Service Profile, otherwise the certificate is imported without binding it. When you edit such an installation, select a binding target type before you save. The next discovery sets unbound installations to No binding.

  9. If you don't want the certificate to be pushed when you save, toggle the Push certificate on save slider to Off.

  10. Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

After saving, the certificate is imported to the template and location you specified and bound to the target you selected. The change is committed to Panorama and pushed to the firewalls, as described in Commit and push. An installation is created on the Installations tab.

Binding targets

SSL/TLS Service Profile

  • Certificate Binding Target Name: Enter the name of the SSL/TLS Service Profile.

  • SSL/TLS Service Profile Location: Enter the vsys of the template that holds the profile, for example vsys1. Leave the field empty if the profile is in the template's Shared location.

    • A certificate in the template's Shared location can be bound to a profile in the Shared location or in any vsys of the template.
    • A certificate in a vsys can only be bound to a profile in the same vsys, so this field must match Location.
    • This field is ignored when Template is empty (the profile must be in Panorama's own configuration) or names a template stack (the profile must be in the stack's Shared location).

The profile holds one certificate: the new certificate replaces the one the profile used before.

Decryption Policy Rule

  • Certificate Binding Target Name: Enter the name of the Decryption Policy Rule.

  • Device Group: Enter the device group that holds the rule. The rule can be in the device group's Pre Rules or Post Rules, and must be of type SSL Inbound Inspection. Rule names are unique across both Pre Rules and Post Rules, so you don't need to say which one holds the rule.

    The device group must be able to reach the certificate's template or template stack: its Reference Templates list must include the template (or a template stack that contains it), or the device group must share at least one firewall with it.

  • Replace Certificate: Choose what happens to a previous version of the certificate (same subject common name and subject alternative names) that is already in the rule:

    • On - The previous version is removed from the rule and the new certificate takes its place, so a renewal does not use up another slot.
    • Off (default) - The previous version stays in the rule and the new certificate is added next to it. Remove the previous version from the rule yourself when you no longer need it.

    In both cases the certificates that are not previous versions stay in the rule.

The previous version stays in the Panorama certificate inventory

With Replace Certificate on, the previous version is only removed from the rule. It is not deleted from the Panorama certificate inventory, because it may still be used by another SSL/TLS Service Profile or Decryption Policy Rule. If it is not used anywhere else and you no longer need it, delete it from the certificate inventory manually.

Decryption Policy Rule certificate limit

Binding to a Decryption Policy Rule requires PAN-OS 10.2 or later, where a rule can hold up to 12 certificates. Provisioning fails if the certificate does not fit:

  • With Replace Certificate off, when the rule already holds 12 certificates.
  • With Replace Certificate on, when the rule already holds 12 certificates and none of them is a previous version of the new certificate.

In both cases the certificate is still imported, but it isn't added to the rule.

Binding validation

Certificate Manager - SaaS checks the template and vsys before it imports the certificate, and checks the binding target before it changes the binding. Nothing is created automatically: if a template, vsys, SSL/TLS Service Profile, device group, or Decryption Policy Rule does not exist, provisioning fails with an error. If the binding target fails its check, the certificate is already imported to the template and location you specified, but it isn't bound or committed. Correct the binding and provision again.

The table below summarizes how the fields are validated for each kind of Template:

Field Template empty (Panorama) Template Template stack
Location Ignored Empty (Shared) or an existing vsys of the template Ignored (always Shared)
SSL/TLS Service Profile Must exist in Panorama's own configuration Must exist at the SSL/TLS Service Profile Location Must exist in the stack's Shared location
SSL/TLS Service Profile Location Ignored Certificate in Shared: Shared or any vsys. Certificate in a vsys: the same vsys Ignored
Decryption Policy Rule Not supported An SSL Inbound Inspection rule in the device group's Pre Rules or Post Rules An SSL Inbound Inspection rule in the device group's Pre Rules or Post Rules
Device Group Ignored Required for a rule, and must reach the template Required for a rule, and must reach the template stack
Replace Certificate Ignored Off: the rule must hold fewer than 12 certificates Off: the rule must hold fewer than 12 certificates

Commit and push

After the certificate is imported and bound, Certificate Manager - SaaS makes one commit to Panorama and one push to the firewalls:

  • Commit - Covers the template or template stack, and the device group of the Decryption Policy Rule.
  • Push - Goes to the device groups that share a firewall with the template or template stack, and to the device group of the Decryption Policy Rule. If no device group matches, the change is pushed to the template stack, to the template stacks that contain the template, or to the template itself.

When Template is empty, the certificate is committed to Panorama's own configuration and nothing is pushed. Certificate Manager - SaaS doesn't wait for this commit to finish, because the connection to Panorama can drop while Panorama applies it.

Changes of other administrators

The commit and the push include only the changes made by the Panorama administrator that Certificate Manager - SaaS connects as. Other administrators' pending or unpushed changes stay as they are, even in the same template, template stack, or device group.

PAN-OS blocks such a selective push when a firewall's last pushed configuration is older than the configuration versions Panorama keeps (Number of Versions for Config Audit). Provisioning then fails with the certificate committed on Panorama. Push the affected device groups or template stacks in full once, then provision again.

Locks

If another administrator holds the Panorama configuration lock, a commit lock, or a firewall's configuration lock, Certificate Manager - SaaS retries for a few minutes and then fails. Provision again once the lock is released: a certificate that is already committed is not committed again, and the push is completed.

If provisioning fails

Provisioning failed State on Panorama What to do
Before or during import, or on the binding validation The certificate may be imported but isn't bound or committed Correct the error and provision again
On the Panorama configuration lock The certificate may be imported but isn't bound or committed Provision again once the lock is released
On a commit lock during the commit The certificate is imported and bound but isn't committed Provision again once the lock is released
On a commit lock or firewall configuration lock during the push The certificate is committed but not pushed Provision again once the lock is released
Because a full push is required The certificate is committed but not pushed Push the affected device groups or template stacks in full, then provision again

A certificate that is imported but not committed stays in the candidate configuration as a change of the Certificate Manager - SaaS administrator. The next successful provisioning to the same template or template stack commits it.