6.5.11 Palo Alto

CertKit provides Windows and Linux Palo Alto Firewall (PAN-OS API) templates. They import the certificate, private key, and intermediate certificates through the PAN-OS XML API and commit the change.

Requirements

• The agent host must reach the firewall management interface over HTTPS.
• The PAN-OS administrator role must allow XML API Import and Commit operations.
• Set New or existing certificate name to update to the object that should be replaced, or use a new name for the first deployment.

Use a stable existing name when other PAN-OS configuration refers to the certificate object. Replacing that name preserves those references. A newly named certificate must be selected in the applicable SSL/TLS Service Profile, GlobalProtect configuration, or other consumer before it affects traffic.

Intermediate certificates

The template imports the intermediate certificates with the leaf certificate. PAN-OS may not display those intermediates as separate objects in the management UI. Their absence from the certificate list does not by itself indicate that the chain was omitted.

Common problems

• Import succeeds but commit fails: confirm the role includes Commit permission and review other pending PAN-OS changes that may block the commit.
• Traffic still uses the old certificate: confirm the updated certificate object is referenced by the active service profile or configuration.
• Authentication succeeds but import is denied: XML API access alone is insufficient; the role must allow the Import operation.
• Management connection fails: verify the hostname or IP, management-interface HTTPS access, and routing from the agent host.

For a product overview, see certificate automation for Palo Alto firewalls.