Other Supported Actions to Manage Certificates
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
End-of-Life (EoL)
Other Supported Actions to Manage Certificates
After you generate the certificate, its details display
on the page and the following actions are available:
Other Supported Actions
to Manage Certificates | Description |
---|---|
Delete | Select the certificate and Delete it. If
the firewall has a decryption policy, you cannot delete a certificate
for which usage is set to Forward Trust Certificate or Forward
Untrust Certificate. To change the certificate usage,
see Manage
Default Trusted Certificate Authorities. |
Revoke | Select the certificate that you want to
revoke, and click Revoke. The certificate
will be instantly set to revoked status. No commit is required. |
Renew | In case a certificate expires or is about
to expire, select the corresponding certificate and click Renew. Set
the validity period (in days) for the certificate and click OK. If
the firewall is the CA that issued the certificate, the firewall replaces
it with a new certificate that has a different serial number but the
same attributes as the old certificate. If an external certificate
authority (CA) signed the certificate and the firewall uses the
Online Certificate Status Protocol (OCSP) to verify certificate
revocation status, the firewall uses the OCSP responder information
to update the certificate status |
Import | Import a certificate
and configure as follows:
When you import a certificate to a Palo
Alto Networks firewall or Panorama server that is in FIPS-CC mode,
you must import the certificate as a Base64-Encoded Certificate
(PEM) and you must encrypt the private key with AES. Also, you must
use SHA1 as the passphrase-based key derivation method. To
import a PKCS12 certificate, convert the certificate to the PEM
format (using a tool such as OpenSSL); ensure that the password phrase
you use during conversion is at least six characters. |
Export | Select the certificate you want to export,
click Export, and select a File Format:
|
Import HA Key | The HA keys must be swapped
across both the firewalls peers; that is the key from firewall 1
must be exported and then imported in to firewall 2 and vice versa. To
import keys for high availability (HA), click Import
HA Key and Browse to specify
the key file for import. To export keys for HA, click Export
HA Key and specify a location to save the file. |
Export HA Key | |
Define the usage of the certificate | In the Name column, select
the certificate and then select options appropriate for how you
plan to use the certificate. |
PDF/CSV | Administrative roles with a minimum of read-only
access can export the managed certificate configuration table as PDF/CSV.
You can apply filters to create more specific table configuration
outputs for things such as audits. Only visible columns in the web
interface will be exported. See Configuration
Table Export. |