How to import CA Cert via CLI

Benny.Rosa — Tue, 17 Jan 2023 20:56:57 GMT

My Panorama CA Cert expired and I cannot renew it via GUI because I cannot get to the GUI interface. How can I do it via CLI.

Re: How to import CA Cert via CLI

Metgatz — Wed, 18 Jan 2023 00:38:43 GMT

Hello @Benny.Rosa

I have not tested these commands myself. I have not had the opportunity or the need to do so, but there is the possibility to do it by CLI.

admin@PA-XXXX> scp import certificate from
<value> Source (username@host:path)

admin@PA-XXXX> scp import certificate from

scp import certificate from <value> remote-port <1-65535> source-ip <ip/netmask> certificate-name <value> passphrase <value> format <pkcs12|pem>

scp import private-key from <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format <pkcs12|pem>

scp import keypair from <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format <pkcs12|pem>

tftp import certificate from <value> file <value> remote-port <1-65535> source-ip <ip/netmask> certificate-name <value> passphrase <value> format <pkcs12|pem>

tftp import private-key from <value> file <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format <pkcs12|pem>

tftp import keypair from <value> file <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format

You can do it from a TFTP server or from a SFTP server

Goog luck

Cheers

Re: How to import CA Cert via CLI

TomYoung — Wed, 18 Jan 2023 01:03:55 GMT

Hi @Benny.Rosa ,

Here is an article that describes your issue with a couple of fixes -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC.

Notice that Option 2 has the CLI commands to generate a new certificate.

Thanks,

Tom

topic How to import CA Cert via CLI in General Topics

How to import CA Cert via CLI

Re: How to import CA Cert via CLI

Re: How to import CA Cert via CLI