Provision certificates to Palo Alto Networks Panorama¶

Provision a certificate from Certificate Manager - SaaS to Palo Alto Networks Panorama®. Certificate Manager - SaaS imports the certificate into the template, template stack, or Panorama configuration you choose, binds it to an SSL/TLS Service Profile or an SSL Inbound Inspection Decryption Policy Rule, commits the change, and pushes it to your firewalls.

Before you begin¶

A Palo Alto Networks Panorama machine that you created and whose status is Verified.
The certificate to provision in the Certificate Manager - SaaS inventory, with its private key.
The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
The template, template stack, virtual system (vsys), SSL/TLS Service Profile, device group, and Decryption Policy Rule that you want to use, already set up in Panorama. Certificate Manager - SaaS doesn't create any of them.

To provision a certificate to Palo Alto Networks Panorama¶

Sign in to Certificate Manager - SaaS.
Click Installations > Machines.
Click the more options button at the end of the machine's row, and then select Provision.
In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

The rest of the Provision a certificate dialog appears after you select a certificate.
Under Certificate Information, in Certificate Name, enter the name for the certificate as you want it to appear in Panorama.

Certificate Manager - SaaS checks whether the name is already in use in the template and location you choose:
- If the name isn't in use, Certificate Manager - SaaS uses it.
- If the name is in use by the same certificate, Certificate Manager - SaaS reuses the existing certificate instead of importing it again.
- If the name is in use by a different certificate, Certificate Manager - SaaS generates a unique name from the certificate's common name, expiration date, and serial number.
(Optional) In Template, enter the template or template stack that stores the certificate. The certificate is pushed to the firewalls that use this template or template stack. Leave it empty to store the certificate in Panorama's own configuration.
(Optional) In Location, enter the vsys of the template that stores the certificate, for example vsys1. Leave it empty to store the certificate in the template's Shared location.

Certificate Manager - SaaS ignores Location when Template is empty, because Panorama's own configuration has no vsys. It also ignores Location when Template names a template stack, because the certificate is stored in the template stack's Shared location.
Under Installation Endpoint, for Certificate Binding Target Type, choose what to bind the certificate to:
- No binding: imports the certificate without binding it.
- SSL/TLS Service Profile: binds the certificate to an SSL/TLS Service Profile, for example one that a GlobalProtect portal or gateway, or the management interface, uses.
- Decryption Policy Rule: adds the certificate to an SSL Inbound Inspection Decryption Policy Rule. This requires a Template.
Note

Installations that you created or discovered before Certificate Binding Target Type became required can have an empty binding target type. They keep working. If the installation has a Certificate Binding Target Name, Certificate Manager - SaaS treats the name as an SSL/TLS Service Profile. Otherwise, Certificate Manager - SaaS imports the certificate without binding it. When you edit such an installation, choose a binding target type before you save. The next discovery sets unbound installations to No binding.
In Certificate Binding Target Name, enter the name of the SSL/TLS Service Profile or Decryption Policy Rule. If you chose No binding, leave it empty. Provisioning fails if you enter a name.
If you chose SSL/TLS Service Profile, in SSL/TLS Service Profile Location, enter the vsys of the template that holds the profile, for example vsys1. Leave it empty if the profile is in the template's Shared location. For the rules, see Binding targets.
If you chose Decryption Policy Rule, in Device Group, enter the device group that holds the rule. For the rules, see Binding targets.
(Optional) If you chose Decryption Policy Rule, to replace the previous version of the certificate in the rule instead of adding the certificate next to it, enable Replace Certificate. It's disabled by default.
(Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS imports the certificate to the template and location you specified, binds it to the target you chose, commits the change to Panorama, and pushes it to the firewalls, as described in Commit and push. An installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.

Binding targets¶

SSL/TLS Service Profile¶

Certificate Binding Target Name is the name of the SSL/TLS Service Profile. SSL/TLS Service Profile Location is the vsys of the template that holds the profile, or empty for the template's Shared location:

A certificate in the template's Shared location can be bound to a profile in the Shared location or in any vsys of the template.
A certificate in a vsys can be bound only to a profile in the same vsys, so SSL/TLS Service Profile Location must match Location.
Certificate Manager - SaaS ignores SSL/TLS Service Profile Location when Template is empty, because the profile must be in Panorama's own configuration. It also ignores it when Template names a template stack, because the profile must be in the stack's Shared location.

The profile holds one certificate, so the new certificate replaces the one the profile used before.

Decryption Policy Rule¶

Certificate Binding Target Name is the name of the Decryption Policy Rule. The rule must be of type SSL Inbound Inspection and can be in the device group's Pre Rules or Post Rules. Rule names are unique across both, so you don't need to say which one holds the rule.

The device group must be able to reach the certificate's template or template stack. Its Reference Templates list must include the template, or a template stack that contains it, or the device group must share at least one firewall with it.

If the certificate is in a vsys, the device group must not push its rules to any other vsys on its firewalls. A rule can use only a certificate in its own vsys or in the Shared location, so provisioning fails before Certificate Manager - SaaS binds or commits the certificate, as described in Binding validation. To fix it, set Location to the vsys that the device group pushes its rules to, or leave Location empty to store the certificate in the template's Shared location. Certificate Manager - SaaS doesn't run this check for a device group that's assigned whole firewalls, with no vsys listed.

Replace Certificate controls what happens to a previous version of the certificate, with the same subject common name and subject alternative names, that's already in the rule:

Enabled: Certificate Manager - SaaS removes the previous version from the rule and puts the new certificate in its place, so a renewal doesn't use up another slot.
Disabled: the previous version stays in the rule and Certificate Manager - SaaS adds the new certificate next to it. Remove the previous version from the rule yourself when you no longer need it.

In both cases, the certificates that aren't previous versions stay in the rule.

Note

With Replace Certificate enabled, Certificate Manager - SaaS removes the previous version only from the rule. It doesn't delete it from the Panorama certificate inventory, because another SSL/TLS Service Profile or Decryption Policy Rule might still use it. If nothing else uses it and you no longer need it, delete it from the certificate inventory yourself.

Note

Binding to a Decryption Policy Rule requires PAN-OS 10.2 or later, where a rule holds a limited number of certificates. Provisioning fails if the certificate doesn't fit:

With Replace Certificate disabled, when the rule is full.
With Replace Certificate enabled, when the rule is full and none of its certificates is a previous version of the new certificate.

In both cases, Certificate Manager - SaaS still imports the certificate but doesn't add it to the rule.

Binding validation¶

Certificate Manager - SaaS checks the template and vsys before it imports the certificate, and checks the binding target before it changes the binding. Nothing is created automatically. If a template, vsys, SSL/TLS Service Profile, device group, or Decryption Policy Rule doesn't exist, provisioning fails with an error. If the binding target fails its check, the certificate is already imported to the template and location you specified, but it isn't bound or committed. Correct the binding and provision again.

The table below summarizes how Certificate Manager - SaaS validates the fields for each kind of Template:

Field	Template empty (Panorama)	Template	Template stack
Location	Ignored	Empty (Shared) or an existing vsys of the template	Ignored (always Shared)
SSL/TLS Service Profile	Must exist in Panorama's own configuration	Must exist at the SSL/TLS Service Profile Location	Must exist in the stack's Shared location
SSL/TLS Service Profile Location	Ignored	Certificate in Shared: Shared or any vsys. Certificate in a vsys: the same vsys	Ignored
Decryption Policy Rule	Not supported	An SSL Inbound Inspection rule in the device group's Pre Rules or Post Rules	An SSL Inbound Inspection rule in the device group's Pre Rules or Post Rules
Device Group	Ignored	Required for a rule, and must reach the template. Certificate in a vsys: the device group must not push its rules to another vsys	Required for a rule, and must reach the template stack
Replace Certificate	Ignored	Disabled: the rule must not be full	Disabled: the rule must not be full

Commit and push¶

After Certificate Manager - SaaS imports and binds the certificate, it makes one commit to Panorama and one push to the firewalls:

Commit: covers the template or template stack, and the device group of the Decryption Policy Rule.
Push: goes to the device groups that share a firewall with the template or template stack, and to the device group of the Decryption Policy Rule. If no device group matches, Certificate Manager - SaaS pushes the change to the template stack, to the template stacks that contain the template, or to the template itself.

When Template is empty, Certificate Manager - SaaS commits the certificate to Panorama's own configuration and pushes nothing. Certificate Manager - SaaS doesn't check that this commit finishes, because the connection to Panorama can drop while Panorama applies it. If another administrator holds a commit lock, Certificate Manager - SaaS doesn't retry this commit. Provision again after the lock is released.

Changes by other administrators¶

The commit includes only the changes of the Panorama administrator that Certificate Manager - SaaS connects as. A push to device groups or template stacks sends only that administrator's changes to firewalls. Other administrators' pending or unpushed changes stay as they are, even in the same template, template stack, or device group.

When the push goes to a template that isn't in any template stack, PAN-OS can't limit it by administrator, so it includes every committed change in that template, not only the changes Certificate Manager - SaaS made. Such a template has no firewalls.

PAN-OS blocks a push limited by administrator when a firewall's last pushed configuration is older than the configuration versions Panorama keeps (Number of Versions for Config Audit). Provisioning then fails, and the certificate stays committed on Panorama. Push the affected device groups or template stacks in full once, and then provision again.

Locks¶

If another administrator holds the Panorama configuration lock, a commit lock, or a firewall's configuration lock, Certificate Manager - SaaS retries for a few minutes and then fails. Provision again after the lock is released. Certificate Manager - SaaS doesn't commit an already committed certificate again, and it completes the push.

If provisioning fails¶

Provisioning failed	State on Panorama	What to do
Before or during import, or on the binding validation	If the certificate was imported, it isn't bound or committed	Correct the error and provision again
On the Panorama configuration lock	If the certificate was imported, it isn't bound or committed	Provision again after the lock is released
On a commit lock during the commit	The certificate is imported and bound but isn't committed	Provision again after the lock is released
On a commit lock or firewall configuration lock during the push	The certificate is committed but not pushed	Provision again after the lock is released
Because a full push is required	The certificate is committed but not pushed	Push the affected device groups or template stacks in full, and then provision again

A certificate that's imported but not committed stays in the candidate configuration as a change by the Panorama administrator that Certificate Manager - SaaS connects as. The next successful provisioning to the same template or template stack commits it.

When a commit or push job fails on Panorama, the error message shows the lines of the job report that explain the failure, up to about 600 characters. The warnings that PAN-OS lists for the whole configuration are left out. If the message leaves anything out, it ends with the job number. To read the full report, find that job in the Panorama Task Manager.