Replace an SSL Certificate on Palo Alto PAN-OS

PAN-OS imports certificates into the candidate configuration. The management web interface, GlobalProtect portals and gateways and most other TLS services do not reference a certificate directly: they reference an SSL/TLS Service Profile, and the profile references the certificate. Nothing changes on the wire until the profile points at the new certificate and the change is committed.

Before you beginCopy Anchor Link

• Record the certificate name, its location (a virtual system or Shared), every SSL/TLS Service Profile and feature that uses it, the intermediate and root CA objects, and the HA state. Opening a certificate in the list shows its details, including the fingerprint.
• Save a snapshot you can return to: Device > Setup > Operations > Save named configuration snapshot.
• Prepare the replacement:
  • a PKCS12 file (certificate, private key and usually the chain in one file, protected by a passphrase), or
  • PEM certificate and PEM private key files, or
  • the signed certificate for a CSR you generated on the firewall. The CSR appears in the certificate list as a pending entry, and its private key is already on the firewall.
• Keep console or out-of-band access: replacing the management certificate can end your current web and API session.

Step-by-step certificate replacementCopy Anchor Link

1. Go to Device > Certificate Management > Certificates. The tab is Device Certificates up to PAN-OS 11.2 and Custom Certificates from PAN-OS 12.1. On a firewall with several virtual systems, choose the Location first, or Shared if more than one virtual system needs the certificate.

2. Click Import and fill in:

   • Certificate Name: case-sensitive, letters, digits, hyphens and underscores, up to 63 characters on a firewall (31 on Panorama). A name with purpose and year such as gp-2026 makes rollback obvious.
   • Certificate File and File Format: PKCS12 (the default) or PEM.
   • For PEM, select Import Private Key and choose the Key File.
   • Passphrase: the passphrase that protects the key in the file.

   CSR generated on the firewall: import the signed certificate under exactly the same name as the pending CSR entry, with File Format PEM and Import Private Key cleared. PAN-OS pairs it with the private key it already holds.

3. If the file did not contain the chain, import the intermediate and root CA certificates the same way, without a key. The certificate list shows which CA certificates are already present.

4. Go to Device > Certificate Management > SSL/TLS Service Profile and edit each profile that should use the new certificate: select it under Certificate. Only select the server certificate there, never a CA certificate.

   Alternatively, create a new profile (for example gp-profile-2026) with the new certificate and select that profile in step 5. Rolling back is then a matter of selecting the old profile again.

5. Select the profile in every service that should use it:

   • Management web interface: Device > Setup > Management, edit General Settings (gear icon), SSL/TLS Service Profile.
   • GlobalProtect portal: Network > GlobalProtect > Portals > portal > Authentication tab > SSL/TLS Service Profile.
   • GlobalProtect gateway: Network > GlobalProtect > Gateways > gateway > Authentication tab > SSL/TLS Service Profile.
   • Other features that reference a certificate directly, such as decryption, in that feature's own settings.

   If you edited an existing profile in step 4 and the services already use it, this step is a check.

6. Click Commit, review the changes and wait until the commit job finishes successfully.

7. In an HA pair, check the High Availability widget on the Dashboard of both firewalls: the running configuration must show as synchronized before any failover.

The same in the CLICopy Anchor Link

Import from an SCP server reachable from the management interface. The CLI asks for the SCP password:

scp import keypair from [email protected]:/certs/gp-2026.p12 certificate-name gp-2026 format pkcs12 passphrase <passphrase>

Use format pem for a PEM file that contains the key. For a certificate without a key - a CA certificate, or the signed certificate for an on-box CSR - use:

scp import certificate from [email protected]:/certs/gp-2026.crt certificate-name gp-2026 format pem

tftp import takes the same arguments where TFTP is allowed. Select the certificate in the SSL/TLS Service Profile (GUI, or set commands in configuration mode), then commit:

configure
commit

Product-specific considerationsCopy Anchor Link

Importing is not activation: a certificate that was imported but never committed, or committed but not selected in a profile, leaves the running service unchanged. Which TLS versions a service offers is set in the SSL/TLS Service Profile, not the certificate.

Verify the new certificateCopy Anchor Link

Test every endpoint by the name clients use:

openssl s_client -connect fw-mgmt.example.com:443 -servername fw-mgmt.example.com -showcerts </dev/null
openssl s_client -connect vpn.example.com:443 -servername vpn.example.com -showcerts </dev/null

Check subject and SAN, issuer, expiry date and that the intermediate is sent. Test the management interface, each GlobalProtect portal and gateway, and connect a GlobalProtect client end to end.

RollbackCopy Anchor Link

• Fastest: select the old certificate in the SSL/TLS Service Profile - or the old profile in each service - and commit.
• If the old certificate object was overwritten: import the saved certificate and key again, select it, and commit.
• Full revert: Device > Setup > Operations > Load named configuration snapshot, select the snapshot you saved, then commit.

Common problemsCopy Anchor Link

• The candidate configuration was never committed.
• The SSL/TLS Service Profile still selects the old certificate.
• The management interface or a GlobalProtect portal or gateway uses a different profile than the one that was edited.
• The certificate was imported into the wrong virtual system, or not into Shared when several need it.
• The signed certificate for an on-box CSR was imported under a different name, so PAN-OS cannot pair it with its key.
• The HA peer has not synchronized the change.

Automating certificate replacement with aethercertCopy Anchor Link

The aethercert PAN-OS target imports a certificate/key pair through the XML API, commits, and waits for the commit job. It does not choose environment-specific SSL/TLS Service Profiles or feature bindings.

See Deploy targets for the fields this preset takes, what it needs on the host, and how far it has been verified.

SourcesCopy Anchor Link

• Palo Alto Networks: import a certificate and private key
• Palo Alto Networks: configure an SSL/TLS Service Profile
• Palo Alto Networks: replace the certificate for inbound management traffic
• Palo Alto Networks: GlobalProtect portal Authentication tab
• Palo Alto Networks: GlobalProtect gateway Authentication tab
• Palo Alto Networks: revert firewall configuration changes