08-01-2023 09:14 AM - edited 08-01-2023 09:18 AM
I do not have Panorama, and as such I always generated CSRs on the local firewall, but it is my understanding you can also do it from Panorama (I suspect its Panorama instructing the local firewall to generate the cert and then downloading the CSR).
If the certificate is signed by a well known CA (i.e. Digicert Global Root G2) the CA certificate is likely already loaded under Device->CertificateManagement->Certificates->DefaultTrustedCertificateAuthorities. You don't need to separately load the parts of a chained certificate (sometimes known as a PK12 file), you can just import the chain directly against the CSR and the PaloAlto will automatically add the rest as needed.
See the KnowledgeBase for importing chained certificate (it references and is the same steps as the KB for importing a signed certificate above):
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkoCAC
If you have signed the certificate with your own private CA, and a complete chained certificate was not provided, then you will need to import the private root CA (and private intermediate CA if so signed) before importing signed certificate against the CSR.
