How to change Certificate on Palo Alto Networks PAN-OS

Learn how to manually import and activate a replacement certificate on PAN-OS, update SSL/TLS Service Profiles, commit, handle HA, and verify services.

PAN-OS imports certificates into candidate configuration. A management interface, GlobalProtect portal/gateway, decryption rule, or other TLS consumer normally selects it through an SSL/TLS Service Profile or feature-specific certificate reference. The change becomes active only after commit.

Before you begin

Record the certificate name, vsys/shared location, service profiles and consumers, intermediate/root objects, HA state, and old fingerprint. Export a configuration snapshot. Prepare PEM or PKCS#12 containing the private key and chain as supported by the PAN-OS release.

Step-by-step certificate replacement

Go to Device > Certificate Management > Certificates > Import. Import the certificate and private key under a controlled name; enter the passphrase where required. Import chain certificates separately and mark CA objects appropriately.
Under Device > Certificate Management > SSL/TLS Service Profile, edit each intended profile and select the replacement certificate. Do not select a CA certificate as the server certificate.
Update feature-specific references not using that profile, such as GlobalProtect or decryption policy objects, according to the feature configuration.
Review the candidate-config diff, then Commit. Wait for the commit job to complete successfully.
In HA, follow the configuration-sync and active/passive maintenance procedure; confirm certificate/key material and commit state on the peer.

Product-specific considerations

Importing is not activation, and a successful import without a successful commit leaves the running service unchanged. TLS 1.3 availability depends on the consumer and service profile. Replacing the management certificate can terminate the current GUI/API session, so preserve console access.

Verify the new certificate

Confirm the certificate object, profile reference, commit job, and HA sync. Test the management interface, each GlobalProtect portal/gateway, and other TLS endpoint separately with SNI and the actual client path.

Rollback

Restore the old profile/feature reference and commit. If the import overwrote the old object, import the saved certificate/key again before committing rollback.

Common problems

Candidate configuration was never committed.
SSL/TLS Service Profile still selects the old certificate.
Certificate was imported in the wrong vsys/shared scope.
HA peer has not synchronized or committed the key material.

Automating certificate replacement with aethercert

The aethercert PAN-OS target imports a certificate/key pair through the XML API, commits, and waits for the commit job. It does not choose environment-specific SSL/TLS Service Profiles or feature bindings.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.