topic Re: Multi-VSYS 11.2.8 - How to assign a dedicated Forward Trust Certificate per VSYS for SSL Decryption in Next-Generation Firewall Discussions

Multi-VSYS 11.2.8 - How to assign a dedicated Forward Trust Certificate per VSYS for SSL Decryption

badermandhouj — Thu, 14 May 2026 19:58:18 GMT

Hi everyone,
I’m running PAN-OS 11.2.8 with Multi-VSYS enabled (3 VSYS). I need a different Forward Trust Certificate per VSYS for SSL decryption, but since my certificates are imported in the Shared store, I can only select one Forward Trust Certificate globally.
Should I import the certificates directly at the VSYS level instead of Shared to fix this?
Any help is appreciated!

Re: Multi-VSYS 11.2.8 - How to assign a dedicated Forward Trust Certificate per VSYS for SSL Decryption

kiwi — Thu, 21 May 2026 13:02:51 GMT

Hi @badermandhouj ,

Correct. Check out the following DOC and particularly steps 3 and 5:

https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/certificate-deployment/import-certificate-and-private-key

Step 3 : If the firewall has more than one virtual system (vsys), select a Location (vsys or Shared) for the certificate.

Step 5 : To make the certificate available to all virtual systems, select the Shared check box. This check box appears only if the firewall supports multiple virtual systems.

Kind regards,