Certificate Management Queries

[kossibolouvi]

Hello guys,
I do have a few questions to ask and see if you can help me out.

1. I do have the RootCA issued by GoDaddy Secure CA-G2 is going to expire in a few days, its something I need to renew or generate a new one?

2. What is the difference between the device certificate, SSL certificate and the Global Protect Certificate because I only have 3 certificates here: One for the SSL certificate, second for the RootCA which its going to expire soon and the third is the Azure SSO certificate GlobalProtect.

3. Last question, Is there an option to setup an Auto-renew for the device certificate because mine only take 3 months and I don't have "Get certificate" option in the management tab so after getting the OTP certificate in the customer support portal, I don't know where exactly to upload the certificate because there's no option for it.

[kiwi]

Hi @kossibolouvi ,

Please find all information on certificate management at https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/certificate-management

When you buy a new cert you can import it at "Device > Certificate Management > Certificates"

Replace any old/expired cert with new one under "Device > Certificate Management > SSL/TLS Service Profile"

Note: If you have multiple profiles you can check which one is configured under GlobalProtect portal and gateway.

As for the Get Certificate option there's a CLI command that might help you.  Please check the following discussion on the same topic:
https://live.paloaltonetworks.com/t5/general-topics/device-certificate-fetch-failure/td-p/514366

Kind regards,

-Kim.