Multi-VSYS 11.2.8 - How to assign a dedicated Forward Trust Certificate per VSYS for SSL Decryption

[badermandhouj]

Hi everyone,
I’m running PAN-OS 11.2.8 with Multi-VSYS enabled (3 VSYS). I need a different Forward Trust Certificate per VSYS for SSL decryption, but since my certificates are imported in the Shared store, I can only select one Forward Trust Certificate globally.
Should I import the certificates directly at the VSYS level instead of Shared to fix this?
Any help is appreciated!

[kiwi]

Hi @badermandhouj ,

Correct.  Check out the following DOC and particularly steps 3 and 5:

https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/certificate-deployment/...

Step 3 : If the firewall has more than one virtual system (vsys), select a Location (vsys or Shared) for the certificate.

Step 5 : To make the certificate available to all virtual systems, select the Shared check box. This check box appears only if the firewall supports multiple virtual systems.

Kind regards,