https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1244966#M6565 <P>You can import CA public key into Palo and set it as Trusted Root CA.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Raido_Rattameister_0-1767709496080.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/70268i5241C1631CC99263/image-size/medium?v=v2&amp;px=400" role="button" title="Raido_Rattameister_0-1767709496080.png" alt="Raido_Rattameister_0-1767709496080.png" /></span></P> <P>&nbsp;</P> Tue, 06 Jan 2026 14:25:05 GMT Raido_Rattameister 2026-01-06T14:25:05Z https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1244905#M6560 <P>Hello everyone. Among the Palo Alto default certificates, there's one that our clients use globally. However, this certificate is missing from the default Palo Alto certificate list. Do you know of any solution?</P> <PRE id="tw-target-text" class="tw-data-text tw-text-large tw-ta" dir="ltr" tabindex="-1" role="text" data-placeholder="번역" data-ved="2ahUKEwiEuujN3_WRAxWZ0jQHHbDSFpkQ3ewLegQIDxAW" aria-label="번역된 텍스트: Hello everyone, among the Palo Alto default certificates, there is a certificate used globally by our customers. However, this certificate is not included in the default certificate in Palo Alto. Is there a solution? The certificate is a root CA (GeotrustRSACA2018)."><SPAN class="Y2IQFc">The certificate is a root CA (GeotrustRSACA2018).</SPAN></PRE> <P>&nbsp;</P> Tue, 06 Jan 2026 01:24:41 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1244905#M6560 JiHwanHam 2026-01-06T01:24:41Z https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1244966#M6565 <P>You can import CA public key into Palo and set it as Trusted Root CA.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Raido_Rattameister_0-1767709496080.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/70268i5241C1631CC99263/image-size/medium?v=v2&amp;px=400" role="button" title="Raido_Rattameister_0-1767709496080.png" alt="Raido_Rattameister_0-1767709496080.png" /></span></P> <P>&nbsp;</P> Tue, 06 Jan 2026 14:25:05 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1244966#M6565 Raido_Rattameister 2026-01-06T14:25:05Z https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1245218#M6583 <P>Cert that is missing - is it used as root cert or intermediate?</P> <P>If you set up decryption profile for web traffic to validate CA and website admin has been ignorant not to embed intermediate certificate into cert file used on web server then web server don't send intermediate together with server own cert (can be easily tested with ssllabs.com test) and Palo will block traffic claiming untrusted cert.</P> Thu, 08 Jan 2026 13:23:39 GMT https://live.paloaltonetworks.com/t5/next-generation-firewall/palo-alto-does-not-support-global-certificates-is-there-a/m-p/1245218#M6583 Raido_Rattameister 2026-01-08T13:23:39Z