How to import CA Cert via CLI

[Benny.Rosa]

My Panorama CA Cert expired and I cannot renew it via GUI because I cannot get to the GUI interface. How can I do it via CLI.

[Metgatz]

Hello @Benny.Rosa 

I have not tested these commands myself. I have not had the opportunity or the need to do so, but there is the possibility to do it by CLI.

admin@PA-XXXX> scp import certificate from
<value> Source (username@host:path)

admin@PA-XXXX> scp import certificate from

scp import certificate from <value> remote-port <1-65535> source-ip <ip/netmask> certificate-name <value> passphrase <value> format <pkcs12|pem>

scp import private-key from <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format <pkcs12|pem>

scp import keypair from <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format <pkcs12|pem>

tftp import certificate from <value> file <value> remote-port <1-65535> source-ip <ip/netmask> certificate-name <value> passphrase <value> format <pkcs12|pem>

tftp import private-key from <value> file <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format <pkcs12|pem>

tftp import keypair from <value> file <value> remote-port <1-65535> source-ip <ip/netmask> passphrase <value> certificate-name <value> format

You can do it from a TFTP server or from a SFTP server

Goog luck

Cheers

[TomYoung]

Hi @Benny.Rosa ,

Here is an article that describes your issue with a couple of fixes -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cli0CAC.

Notice that Option 2 has the CLI commands to generate a new certificate.

Thanks,

Tom