Cloud NGFW uses certificates to enable outbound decryption. These certificates are stored in the
Azure Key Vault.
Only self-signed and root CA signed certificates are
currently supported for decryption. Chained certificates are not supported.
PAN-OS version 11.0.x is required when using Azure Key Vault
for outbound decryption.
Click the Local Rulestacks icon from the homepage and
select a previously created rulestack on which you wish to create a certificate.
Click Certificates on the left
pane and click Add. The Add Certificate List
pane opens.
Enter a descriptive Name for your
certificate.
( optional) Enter a description for your certificate.
If the certificate is self-signed, check Self
Signed Certificate.
If the certificate isn't self-signed, then obtain Certificate URI by navigating
to and copy-paste the Secret Identifier URI in
Certificate URI.
( optional) In the Certificate source field,
choose the respective option: Select from Key vault or
Paste URI.
Click Add.
Navigate to Azure Key Vault> Access Policies.
Click Create to configure an access policy that assigns Key Vault
Certificates Officer and Key Vault Secrets User to the managed
identity created in step 9.
