Palo Alto Networks Prisma Access¶

Provision a certificate whose private key Certificate Manager - SaaS holds. Certificate Manager - SaaS can't install a certificate without its private key.

1. In the Certificate Manager - SaaS toolbar, click Machines.
2. Click the more options button at the right end of the Prisma Access machine's row, and then select Provision.

3. From the Search a certificate by name, expiration, or fingerprint field, begin typing the certificate name you want to provision. Click the certificate when it appears in the list.

4. Under Certificate Information, in Certificate Name, enter the base name for the certificate object in Strata Cloud Manager, or leave (unset) to derive the name from the certificate's common name.

   Certificate Manager - SaaS cuts the base name to 20 characters, removes any spaces, hyphens (-), underscores (_), or periods (.) that the cut leaves at the end, and adds -vc and an 8-character hash of the certificate. For example, branch-office-vpn-certificate becomes branch-office-vpn-ce-vc followed by the hash. In a name derived from the common name, every character other than a letter, digit, space, hyphen, underscore, or period becomes an underscore. Because the hash comes from the certificate, every renewal creates a new certificate object, and installing the same certificate again reuses the existing object.

5. In Certificate Folder, enter the Strata Cloud Manager folder to import the certificate into, such as Shared, Mobile Users, Remote Networks, or Service Connections. The default is Shared.

   Note

   The object that uses the certificate must be able to see this folder, so enter the object's own folder or a folder above it, such as Shared. Certificate Manager - SaaS imports certificates only into folders, not into snippets or onto devices. If discovery found the certificate in a snippet or on a device, change Certificate Folder to a folder before you provision.

6. Leave Certificate Object as it is. The field is read-only. Certificate Manager - SaaS fills it in with the name of the certificate object that holds the installed certificate.

7. Leave Superseded Certificate Object as it is. The field is read-only. When you renew a certificate, Certificate Manager - SaaS fills it in with the certificate object that the new certificate replaces.

8. Under Certificate Usage, from the Object Type drop-down, select the kind of object that uses the certificate:

   • TLS Service Profile: a TLS service profile, such as one that a GlobalProtect portal or gateway uses. The portals and gateways that use the profile pick up the new certificate.
   • IKE Gateway: an IKE gateway of a Remote Network or Service Connection IPsec tunnel. The gateway must authenticate with a certificate, not a pre-shared key.
   • Not Bound: imports the certificate without changing any configuration. This is the default.

9. In Object Name, enter the name of the TLS service profile or IKE gateway. If you selected Not Bound, leave (unbound), including the parentheses.

10. In Object Folder or Snippet, enter the folder or snippet that defines the object. A folder that only inherits the object doesn't count. Certificate Manager - SaaS pushes the change to that folder, or to every folder that the snippet is attached to. The default is Shared.

    Note

    Certificate Manager - SaaS can't configure an object that's defined on a device, or an object in a snippet that isn't attached to any folder, because it can't push either change.

11. If you don't want the certificate to be pushed when you save, toggle the Push certificate on save slider to Off.

12. Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

After you save, Certificate Manager - SaaS imports the certificate, its private key, and its chain into the certificate folder as a new certificate object. It then points the TLS service profile or IKE gateway at the new object, reads the object back to confirm the change, and pushes the configuration. Certificate Manager - SaaS waits up to 4 minutes for the push job to finish. An installation appears on the Installations tab. With Not Bound, Certificate Manager - SaaS only imports the certificate.

When you renew a certificate, Certificate Manager - SaaS deletes the superseded certificate object after it rebinds the TLS service profile or IKE gateway, and pushes the deletion. It deletes the object only if all of these are true:

• Certificate Manager - SaaS created the object. Its name ends in -vc and a hash.
• The object is in the certificate folder itself.
• Nothing references the object anymore.

Certificate Manager - SaaS never deletes an object when the installation's object type is Not Bound.