Remove Device Certificate

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Remove Device Certificate

L1 Bithead

We would like to remove the device certificate from a couple of our firewalls.  We don't use or need the device certificates at this time and would prefer them not be installed.

 

I tried to do a factory reset and the certificate automatically downloaded and installed itself.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Why would you not want it there? it's (only) used for secure communication with Palo Alto cloud services so won't be used if you have no cloud subscriptions

 

If you want to 'break' it, you could generate a new OTP via the support portal and then simply not import it onto your firewall (but again to my first line, why would you not want it there?)

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

6 REPLIES 6

L5 Sessionator

Hello,

 

What are you needing to remove the device certificate entirely for? Its used for various communication with PAN services. If you would want to the device to not grab its device certificate you would need to block the connection to the CSP.

Cyber Elite
Cyber Elite

Why would you not want it there? it's (only) used for secure communication with Palo Alto cloud services so won't be used if you have no cloud subscriptions

 

If you want to 'break' it, you could generate a new OTP via the support portal and then simply not import it onto your firewall (but again to my first line, why would you not want it there?)

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

We do not have device certificates on any of our other devices.  It was just odd that the cert seemed to auto-install on this firewall (a 5410 on 10.2.x).  We don't use any of the cloud services and I didn't create a OTP through the support portal.  It was requested by a senior member of our team to remove it.  I'm guessing because we don't use any of the services.

 

I also noticed that the certificate auto installed on some new 440's that we are working on deploying.

 

I found out from our SE that I would need root access via TAC in order to try to remove it, and that doesn't guarantee it won't reinstall itself.

 

I plan on leaving it for now.

L0 Member

Can I ask a question related to this?

ofcourse!

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L0 Member

@jwill2 wrote:

We would like to remove the device certificate from a couple of our firewalls.  We don't use or need the device certificates at this time and would prefer them not be installed.

 

I tried to do a factory reset and the certificate automatically downloaded and installed itself.


To prevent automatic certificate installation after a factory reset, ensure to disconnect from any network during setup or configure network settings to avoid automatic downloads.

Best Regrards Birthmark removal dubai
  • 1 accepted solution
  • 1515 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!