topic Re: ACME and SSL decryption in General Topics

ACME and SSL decryption

itassetbenilde — Tue, 15 Apr 2025 02:25:34 GMT

So i recently got wind of this:

https://www.thesslstore.com/blog/47-day-ssl-certificate-validity-by-2029/

acme.sh and/or certbot takes care of the servers, but won't this break existing SSL decryption rules?

Any strategies/workarounds for this? tia

Re: ACME and SSL decryption

OtakarKlier — Tue, 15 Apr 2025 18:53:04 GMT

Hello,

Yes an expired certificate will give users with cert errors. If you have internal certificate servers for active directory, use that instead since all the machines will already trust it. You can generate a self signed certificate from the firewall and copy it to all the clients so they accept it.

Regards,

Re: ACME and SSL decryption

itassetbenilde — Fri, 07 Aug 2026 06:08:19 GMT

Does Palo Alto have an equivalent mechanism for updating certificates on the firewall, particularly for SSL inbound inspection? i can see how ACME can break SSL decryption at every renewal.

Re: ACME and SSL decryption

kiwi — Fri, 07 Aug 2026 10:46:27 GMT

Hi @itassetbenilde ,

While PAN-OS 11.0+ introduced ACME support for Let's Encrypt, extending automated ACME workflows for specific enterprise CAs is currently tracked under an existing Feature Request: Automatic PAN-OS ACME Trusted Certificate Renewal Support.

Please reach out to your local Palo Alto Networks Systems Engineer (SE) or Account Team and ask them to add your vote to this Feature Request.

Increasing the vote count helps our Product Management team prioritize this on the roadmap.

Your SE can also provide the most up-to-date roadmap details regarding this request!

Kind regards,