Panorama and Paloalto Firewall Communication

[Ramakrishnan]

Dear Folks, 

I have firewall and Panorama in a large scale deployment. I would like to understand the process and procedure Device Certificate,

As per project plan we are going to deploy Panorama first following deployment of local managed firewalls. So expedite the locally PKI signed certificate [from PKI team] for communication and integration purposes, shall we we generate the CSR from Panorama and get certificate signed [Internal PKI server] is that certificate will be installed for communication on Panorama to SIEM[install the same on SIEM] and then same certificate can installed on local firewall(s)  to SIEM and other integrations?

Preciously to ask If we generate the CSR from Panorama and get the signed certificate, Is that certificate shall be used in other firewalls or can not be used? If CSR is locally significant do we need to raise the CSR from each 400+ firewall individually and get the sighed certificate, what would be the standard approach.