Remove Device Certificate

[jwill2]

We would like to remove the device certificate from a couple of our firewalls.  We don't use or need the device certificates at this time and would prefer them not be installed.

I tried to do a factory reset and the certificate automatically downloaded and installed itself.

[Claw4609]

Hello,

What are you needing to remove the device certificate entirely for? Its used for various communication with PAN services. If you would want to the device to not grab its device certificate you would need to block the connection to the CSP.

[reaper · Accepted solution]

Why would you not want it there? it's (only) used for secure communication with Palo Alto cloud services so won't be used if you have no cloud subscriptions

If you want to 'break' it, you could generate a new OTP via the support portal and then simply not import it onto your firewall (but again to my first line, why would you not want it there?)

[jwill2]

We do not have device certificates on any of our other devices.  It was just odd that the cert seemed to auto-install on this firewall (a 5410 on 10.2.x).  We don't use any of the cloud services and I didn't create a OTP through the support portal.  It was requested by a senior member of our team to remove it.  I'm guessing because we don't use any of the services.

I also noticed that the certificate auto installed on some new 440's that we are working on deploying.

I found out from our SE that I would need root access via TAC in order to try to remove it, and that doesn't guarantee it won't reinstall itself.

I plan on leaving it for now.

[GiannaFlores]

Can I ask a question related to this?

[reaper]

ofcourse!