Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment?

[melissa59zebrowski]

Hello,

I am working with an IPsec VPN setup on my Palo Alto Networks firewall and am currently using certificate-based authentication. My organization utilizes an internal Certificate Authority (CA) that supports ACME (Automatic Certificate Management Environment) for certificate enrollment. However, I haven't been able to find any resources or forums indicating whether Pan-OS supports ACME for automated certificate management.

Is there a way to configure Pan-OS to integrate with an ACME server for certificate enrollment? Any guidance or documentation would be greatly appreciated!

Thank you!

[JayGolf]

Hi @melissa59zebrowski ,

PAN-OS does not natively support ACME. You will have to leverage SCEP for auto cert enrollment. 

[ganderson-rw]

This really needs to change.  ACME is a standard protocol and automation is going to become critical as certificate length gradually decreases down to 47 days maximum in 2029.  This is a security feature, I would like to think Palo Alto would be ahead of the curve on this one, not playing catch up...

Certificate expiry will be down to 6 months as of March next year 2026.

Please, help us.