topic Re: Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment? in Next-Generation Firewall Discussions

Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment?

melissa59zebrowski — Sat, 11 Jan 2025 10:19:33 GMT

Hello,

I am working with an IPsec VPN setup on my Palo Alto Networks firewall and am currently using certificate-based authentication. My organization utilizes an internal Certificate Authority (CA) that supports ACME (Automatic Certificate Management Environment) for certificate enrollment. However, I haven't been able to find any resources or forums indicating whether Pan-OS supports ACME for automated certificate management.

Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment? Any guidance or documentation would be greatly appreciated!

Thank you!

Re: Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment?

JayGolf — Thu, 16 Jan 2025 04:06:32 GMT

Hi @melissa59zebrowski ,

PAN-OS does not natively support ACME. You will have to leverage SCEP for auto cert enrollment.

Re: Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment?

ganderson-rw — Thu, 03 Jul 2025 05:45:18 GMT

This really needs to change. ACME is a standard protocol and automation is going to become critical as certificate length gradually decreases down to 47 days maximum in 2029. This is a security feature, I would like to think Palo Alto would be ahead of the curve on this one, not playing catch up...

Certificate expiry will be down to 6 months as of March next year 2026.

Please, help us.

Re: Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment?

jansimunek — Wed, 14 Jan 2026 09:03:35 GMT

Hello, is there any update of the ACME client native integration to PAN-OS? Should we expect that feature in the upcoming releases?