Best Practice for Managing Short-Lived Public Certificates with Panorama?

[kosarbnu]

Hello everyone,

With publicly trusted SSL/TLS certificates moving toward much shorter validity periods, I'm reviewing how we manage certificates across our Palo Alto environment and would appreciate some advice from those who have already addressed this.

Our environment is managed by Panorama, and several firewalls will be using SAML authentication. As certificate renewals become more frequent, manually importing and deploying certificates multiple times a year doesn't seem like a sustainable long-term approach.

I'm interested in learning what others are doing in production.

Some questions I have:

• What is your preferred method for managing public certificate renewals in a Panorama-managed environment?

• Have you implemented any automation for certificate import and deployment?

• Are you using ACME, Let's Encrypt, or another certificate automation solution with PAN-OS?

• If you're using SAML, have you encountered any issues when replacing certificates on a regular basis?

• Are there any official best practices or recommended workflows to minimize administrative effort?

I've found a few older discussions and third-party guides, but I'm hoping to hear what the current recommendation is based on real-world deployments.

Thanks in advance for sharing your experience!