topic Re: How to configure a site to site VPN with Self signed certificate in General Topics

How to configure a site to site VPN with Self signed certificate

Jedi_D — Wed, 19 Feb 2020 00:16:02 GMT

Hello folks,

This might be a newbie type of question so I appreciate your patience.....

I need to create a site to site VPN using a self signed certificate. I'm happy to do the site to site VPN. But ........... I'm not sure how to use self signed certs for doing this. Does anyone have any procedure of how to do this using certificates? Are there any links that would help me get started? I've only found this for pan-os 6 but I'm using pan-os 8

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJdCAK

Do I need to create a Self-Signed Root CA Certificate first ?? before I generate a certificate?

Any help appreciated! Thank you.

Rgds

Dinesh

Re: How to configure a site to site VPN with Self signed certificate

BPry — Wed, 19 Feb 2020 03:55:25 GMT

@Jedi_D,

The process hasn't changed; following the linked KB article should work perfectly fine.

Re: How to configure a site to site VPN with Self signed certificate

Jedi_D — Wed, 19 Feb 2020 08:51:42 GMT

Hi thanks,

That's good to know....

I'm just confused on one of the steps....

Is there any more info how to do the following.... sorry for being a noddie, but I havent done this before and just wanted to get a handle of it...

Now generate on a client certificate on both firewalls and sign each one with the imported CA certificate.

Re: How to configure a site to site VPN with Self signed certificate

ET — Wed, 27 Aug 2025 13:39:55 GMT

Data Not Available

The data you were trying to access could not be found. It may be due to another user deleting the data or a system error. If you know the data is not deleted but cannot access it, please look at our support page.

Re: How to configure a site to site VPN with Self signed certificate

kiwi — Wed, 27 Aug 2025 14:18:37 GMT

Hi @ET ,

Step 6 in the following DOC explains how to configure certificate-based authentication.

https://docs.paloaltonetworks.com/network-security/ipsec-vpn/administration/set-up-site-to-site-vpn/set-up-an-ike-gateway#id47a6f121-466d-48fa-96f6-b122cd225c06

Step 6.1 links to how to generate a self signed cert:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/certificate-management/obtain-certificates/create-a-self-signed-root-ca-certificate

Hope this helps,

Kim.