Change forward decrypt trust cert to a new one.

[djon]

I have forward ssl decrypt running and I want to change the cert I use. Can only have one forward trust cert at a time. If I deselect forward trust box I get commit error because my ssl decrypt policies don't have a forward trust cert. I can't select forward trust on the new cert until the old cert has forward trust deselected.

So now what do I do? Thanks.

[emr_1]

You don't need to "deselect and commit".

Just change cert and commit will work (at least worked on my lab / pan-os 10.1.6-h6)

[djon]

Thanks for response. I am not able to select Forward Trust Cert option.

The new cert is the Issuing CA Trusted Root chained from the Root CA if this makes ant sense.

[emr_1 · Accepted solution]

Do you have private key for it?

Following two screenshots are sample that shows what happens if you did not import private key ( looks same as your result):

[djon · Accepted solution]

No priv. key. We are making a new cert from our CA and including keys so we can d/l the cert and key. We just have to figure the flavor of cert (usage etc). We made the current one so we should be able to make a new one. Thanks for the tip on needing the priv key to qual for Forward trust.