>
    Strata Copilot
    Device > Certificate Management > SSL/TLS Service Profile
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Device
    4. Device > Certificate Management > SSL/TLS Service Profile
    Download PDF
    Next-Generation Firewall

    Device > Certificate Management > SSL/TLS Service Profile

    Table of Contents

    Device > Certificate Management > SSL/TLS Service Profile

    • Device > Certificate Management > SSL/TLS Service Profile
    • Panorama > Certificate Management > SSL/TLS Service Profile
    SSL/TLS service profiles specify a server certificate and a protocol version or range of versions for firewall or Panorama services that use SSL/TLS (such as administrative access to the web interface). By defining the protocol versions, the profiles enable you to restrict the cipher suites that are available for securing communication with the client systems requesting the services.
    In the client systems that request firewall or Panorama services, the certificate trust list (CTL) must include the certificate authority (CA) certificate that issued the certificate specified in the SSL/TLS service profile. Otherwise, users will see a certificate error when requesting the services. Most third-party CA certificates are present by default in client browsers. If an enterprise or firewall-generated CA certificate is the issuer, you must deploy that CA certificate to the CTL in client browsers.
    To add a profile, click Add, and then complete the fields in the following table.
    SSL/TLS Service Profile Settings
    Description
    Name
    Enter a name to identify the profile (up to 31 characters). The name is case-sensitive. It must be unique and use only letters, numbers, spaces, hyphens, and underscores.
    Shared
    If the firewall has more than one virtual system (vsys), selecting this option makes the profile available on all virtual systems. By default, this option is cleared and the profile is available only for the vsys selected in the Device tab, Location drop-down.
    Certificate
    Select, import, or generate a server certificate to associate with the profile (see Manage Firewall and Panorama Certificates).
    Do not use certificate authority (CA) certificates for SSL/TLS services; use only signed certificates.
    Post-quantum cryptography (PQC) certificates are not available for selection. They are for experimental use only.
    Protocol Settings
    Select the minimum (Min Version) and maximum (Max Version) TLS version that services can use: TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3.
    To provide the strongest security for your network, use the strongest version of the protocol you can. If you can, set the Min Version and Max Version to TLSv1.3.
    On firewalls in FIPS/CC mode running PAN-OS 8.0 or a later release, TLSv1.1 is the earliest supported TLS version; do not select TLSv1.0.
    Client certificates that are used when requesting firewall services that rely on TLSv1.2 cannot have SHA512 as a digest algorithm. The client certificates must use a lower digest algorithm (such as SHA384) or you must limit the Max Version to TLSv1.1 for the services.
    Key Exchange Algorithms
    Classical
    Deselect or select classical key exchange algorithms.
    RSA, DHE, and ECDHE are enabled by default.
    Post-quantum Cryptography (PQC)
    Add, modify, or delete quantum-resistant key exchange algorithms.
    PQC support is limited to TLSv1.3 connections. You can configure PQC algorithms only if TLSv1.3 is enabled in the Protocol Settings.
    • To add a PQC algorithm, click Add, and then specify the following:
      1. Algorithm—Select ML-KEM (Module-Lattice-based Key Encapsulation Mechanism).
      2. Security Level—Select at least one. Each security level corresponds to one of three ML-KEM parameter sets specified in FIPS 203. Higher security levels offer greater protection but reduced performance.
        • Level 1 corresponds to ML-KEM-512
        • Level 3 corresponds to ML-KEM-768
        • Level 5 corresponds to ML-KEM-1024
      3. PQC Supported Groups—Select at least one key exchange group. The available groups depend on your selected security levels and include options for generating session keys through PQC only and hybrid PQC.
        Hybrid post-quantum key exchange combines Elliptic Curve Cryptography (ECC) and ML-KEM (for example, X25519_MLKEM768), providing protection against both classical and quantum computers. The classical curves supported for hybrid key agreement are x25519, x448, p256, p384, and p512.
    • To modify PQC algorithms:
      1. In the row with the parameters to modify, select either Security Level or PQC Supported Groups.
      2. To add an option, select it from the dropdown.
      3. To remove an option, click the X icon.
    • To delete a PQC algorithm, select the row with the PQC configuration you want to delete, and then click Delete.
    Encryption Algorithms
    Deselect or select encryption algorithms.
    For a list of supported encryption algorithms, see Cipher Suites Supported in PAN-OS 12.1.
    All encryption algorithms supported for the specified range of TLS protocol versions are selected by default.
    Authentication Algorithms
    Deselect or select authentication algorithms: SHA1, SHA256, or SHA384.
    For a list of supported authentication algorithms, see Cipher Suites Supported in PAN-OS 12.1.

    © 2026 Palo Alto Networks, Inc. All rights reserved.