Panorama cluster web certificate

[radp]

panorama cluster web certificate | Palo Alto Networks Live

Hello All, I wanna use our PKI and created certificate for primary Panorama to not get WEB cert. error but I`m not able to do so on standby as it saing:

"Configuration changes not allowed on the passive Panorama"

Is there any step I`m missing or its not possible to do so?

THX for any replau

Shared with Jive Anywhere

https://live.paloaltonetworks.com/search.jspa?q=panorama+cluster+web+certificate

[bat]

Hi radp

Did you do a commit on active panorama after generating the certificate ?

You should be able to see the certificate on standby panorama after the commit.

Thanks

[radp]

Yes I see cert from active panorama but its no for stand by as CN is just for active one.

Do I need to have both CNs in this certificate, as it would be different behavior then on FWs where I has to create separate certificates (web certificates are not sunced to peer)

Radek

[bat · Accepted solution]

radp

Try creating a new certificate on primary Panorama itself to be used as a web certificate on standby.

Do a commit on active and then mark it as a web cert on standby panorama

Now do a commit on passive.

Let me know if that helps.

Thanks

[radp]

This could make sense. Thanks for suggestion. This will take same time as certificate has to bi signed be external CA / different departmen

Radek

[radp]

Thank you all is working as you suggested!