Sectigo Root CA Trusted Store Request

[L.Yalezo]

Greetings,

Sectigo has (recently) updated their Public Root Certificates (mid-2025), introducing new roots including: 

- RSA: Sectigo Public Server Authentication Root R46(https://crt.sh/?d=4256644734) 

KB Articles for reference: https://www.sectigo.com/knowledge-base/detail/Sectigo-Root-Certificates

https://www.sectigo.com/knowledge-base/detail/Sectigo-Root-Certificates

https://www.sectigo.com/knowledge-base/detail/Sectigo-new-Public-Roots-and-Issuing-CAs-Hierarchy

https://www.sectigo.com/resource-library/changes-to-root-ca-hierarchies-and-trust-status

Currently, this root certificate is not present in Palo Alto’s Default Trusted Certificate Authorities store, as it is relatively new. The following Sectigo/COMODO roots are included today:

1. USERTrust RSA Certification Authority - https://crt.sh/?id=1199354 

2. USERTrust ECC Certification Authority - https://crt.sh/?id=2841410
3. COMODO RSA Certification Authority - https://crt.sh/?id=1720081 
4. COMODO ECC Certification Authority - https://crt.sh/?id=2835394

Would it be possible to have Sectigo Public Server Authentication Root R46 (https://crt.sh/?d=4256644734) included in Palo Alto's Default Trusted Certificate Authority store? 

[kiwi]

Hi @L.Yalezo ,

In the Palo Alto ecosystem, the Default Trusted Certificate Authorities store is historically updated via major PAN-OS releases (e.g., moving from 10.2.x to 11.1.x or 11.2.x).

• PAN-OS Updates: This is the primary vehicle for permanent root store changes. Palo Alto usually syncs their default store with the Mozilla/Google root programs during the development of a new maintenance or feature release.

It will likely appear in a future release of the 11.2 or 12.0 trains.

Manual import is a workaround to address the issue.

Kind regards,

[L.Yalezo]

Hi @kiwi 

Thank you for the prompt feedback. 

It’s possible that this root certificate, along with others, will be included in future releases of the 11.2 or 12.x trains, pending Palo Alto’s vetting process given that they are fairly new. According to this blog: https://blog.bressem.com/2025/11/palo-alto-is-missing-the-new-sectigo-root-cas/ this root certificate is still missing in versions 11.2.7-h4, 11.2.10 and 12.1.3-h1.

I was wondering if perhaps there are avenues to submit a feature request for including this root certificate, like one would do when requesting a reclassification of an application.

Many thanks.