topic Re: What certificate to use for Palo Alto-provided EDL validation in General Topics

What certificate to use for Palo Alto-provided EDL validation

paolopoz — Thu, 02 Apr 2026 09:25:57 GMT

Hello all,

I am trying to tide up a bit the EDL configuration in our Panorama.

We are using some of the EDLs which Palo Alto provides as optional.

Following the official documentation at this link:

https://docs.paloaltonetworks.com/network-security/security-policy/administration/objects/external-dynamic-lists/configure-the-firewall-to-access-an-external-dynamic-list-from-the-edl-hosting-service/create-an-external-dynamic-list-using-the-edl-hosting-service-panorama

I need to use the GlobalSign Root certificate to authenticate the EDL Hosting Service.

However if I follow other guides (for example this YT video: https://www.youtube.com/watch?v=Vpy677VOV20 ) and I do it for Palo Alto Hosting Service I find a different root certificate provided by Google and which is obviously different from the one referred to into the docs.

At this point I do not know which one to use. Do you have any advice?

Thanks.

Re: What certificate to use for Palo Alto-provided EDL validation

TomYoung — Thu, 02 Apr 2026 21:04:42 GMT

Hi @paolopoz ,

Always follow the steps in the video. Browse to your EDL URL and view the certificates in the browser. Those certificates are the ones the site is using. I use certificate profiles with all my EDLs. Sometimes the sites change their certs, but otherwise you set it up once and it works. Like the video, I download and add every certificate in the chain to my certificate profile.

Thanks,

Tom

Re: What certificate to use for Palo Alto-provided EDL validation

paolopoz — Tue, 07 Apr 2026 07:39:35 GMT

Thank you @TomYoung !

I provided a feedback on that documentation page so that hopefully it can be updated.