Palo Alto does not support global certificates. Is there a solution?

[JiHwanHam]

Hello everyone. Among the Palo Alto default certificates, there's one that our clients use globally. However, this certificate is missing from the default Palo Alto certificate list. Do you know of any solution?

The certificate is a root CA (GeotrustRSACA2018).

[Raido_Rattameister · Accepted solution]

You can import CA public key into Palo and set it as Trusted Root CA.

[Raido_Rattameister]

Cert that is missing - is it used as root cert or intermediate?

If you set up decryption profile for web traffic to validate CA and website admin has been ignorant not to embed intermediate certificate into cert file used on web server then web server don't send intermediate together with server own cert (can be easily tested with ssllabs.com test) and Palo will block traffic claiming untrusted cert.