Certificates duplicated from Primary to Secondary firewall in Palo alto

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Certificates duplicated from Primary to Secondary firewall in Palo alto

L0 Member

Hi All,


We have 2 Palo alto firewalls in HA mode (Active-standby).

Palo alto mode: PA-3220

OS Version: 10.1.6-h3


We create Unique certificates (for management, interdevice) in each firewall with hostname. After some time, the certificates in secondary firewall gets removed and the certificates from primary firewall are copied into secondary firewall..


Cyber Elite


For example: Primary firewall hostname and certificates: Hostname:PrimaryFW Certificate name: PrimaryFW

Secondary firewall hostname: SecondaryFW; Certificate name: SecondaryFW


After some time,, the seconday firewall certificates are deleted, and the primary firewall certificates are visible in the secondary firewall.. is it a bug? @aleksandar.astardzhiev @Jafar_Hussain @DelvinC 


Hi @Sai14091990 ,

According to documentations certificates are not synced between Active/Passive HA member - What Settings Don’t Sync in Active/Passive HA? (paloaltonetworks.com)


There is very important note mentioned on that link



So what you experience shouldn't be normal, and I suspect that you are using different certificate names. Don't confuse Common Name (CN) with name - latter is the name of the certificate object you put when importing/generating the certificate.


Try to import the certificate for secondary member again and set exactly the same name as the mgmt certificate on the primary member and see if this will help.

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!