https://live.paloaltonetworks.com/t5/next-generation-firewall/migrating-certs-from-one-palo-to-another/m-p/1235768#M6186 <P>Hello,<BR /><BR /></P><P>When you bring a new Palo Alto firewall into a device group via Panorama (or replace an old firewall), Panorama does not automatically copy certificates from the old device to the new one. Certificates live in the firewall’s local certificate store, not in the device group configuration, so you have to move them manually.</P> Mon, 11 Aug 2025 11:06:00 GMT max674lowes 2025-08-11T11:06:00Z https://live.paloaltonetworks.com/t5/next-generation-firewall/migrating-certs-from-one-palo-to-another/m-p/1235660#M6179 <P>What is the process when migrating certs?&nbsp;<BR />are the added when new palo joins the device group?</P> <P>do I need to import export the top level cert?</P> <P>do I need to import the trusted root provided by customer or can I use what is already on the old palo?</P> <P>thank you&nbsp;</P> <P>&nbsp;</P> Fri, 08 Aug 2025 04:02:06 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/migrating-certs-from-one-palo-to-another/m-p/1235660#M6179 PaloNetworkMonkey 2025-08-08T04:02:06Z https://live.paloaltonetworks.com/t5/next-generation-firewall/migrating-certs-from-one-palo-to-another/m-p/1235768#M6186 <P>Hello,<BR /><BR /></P><P>When you bring a new Palo Alto firewall into a device group via Panorama (or replace an old firewall), Panorama does not automatically copy certificates from the old device to the new one. Certificates live in the firewall’s local certificate store, not in the device group configuration, so you have to move them manually.</P> Mon, 11 Aug 2025 11:06:00 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/migrating-certs-from-one-palo-to-another/m-p/1235768#M6186 max674lowes 2025-08-11T11:06:00Z