Knowledge Base

Overview

By the end of this article you will have an issued SSL certificate installed on your Palo Alto firewall and applied to the management interface, so administrators reach the firewall over an encrypted, trusted HTTPS connection. The article covers the prerequisites you need before you start, the import steps in Device > Certificate Management, how to assign the certificate through an SSL/TLS Service Profile, and how to verify the installation in a browser. The certificate you import must match the Certificate Signing Request (CSR) you generated on the firewall, and it must be imported under the same certificate name used for that CSR.

Prerequisites

Confirm you have all of the following before you begin the import:

• Administrator access to the Palo Alto firewall web interface
• The issued SSL certificate file, matching the Certificate Signing Request (CSR) generated on this firewall
• The exact certificate name used when the CSR was created
• Permission to commit configuration changes on the firewall

Steps to install the SSL certificate on a Palo Alto firewall

Complete these steps in the firewall web interface, in order:

1. Go to Device > Certificate Management > Certificates.
    
   
   Figure 1: Palo Alto firewall Device tab with Certificate Management and Certificates selected  
   
   
2. Click Import to start the certificate upload.
    
   Figure 2: Certificates page with the Import button at the bottom of the certificate list 
   
   
3. Select the certificate file, and enter the certificate name exactly as it was used during the Certificate Signing Request (CSR) generation.
4. Click OK to complete the import. The certificate now appears in the certificates list.

 
Figure 3: Import Certificate dialog with the certificate name and certificate file fields completed 

Assign the certificate to management services

After the import, the certificate is stored on the firewall but is not yet in use. Assign it as follows:

1. Go to Device > Setup > Management.
2. Click the gear icon under General Settings.
3. In the SSL/TLS Service Profile section, select the profile that uses the certificate you imported.
4. Click OK, then Commit the changes to apply the configuration.

Verification

Confirm the installation was successful before closing the session:

• Open the firewall management interface over HTTPS in a browser.
• Confirm the browser shows a valid certificate with no security warnings.
• Open the certificate details and confirm the certificate name and issuing authority are the expected ones.

Similar questions

• How do I import an SSL certificate into a Palo Alto firewall?
• How do I apply a certificate to the Palo Alto management interface?
• Why does my Palo Alto firewall still show a certificate warning after importing a certificate?

Related Articles:
     How to Generate a CSR on a Palo Alto Networks Firewall? | Sectigo® Official