Add a Certificate to Cloud NGFW for Azure

Table of Contents

Learn how to add a certificate to Cloud NGFW for Azure.

Where Can I Use This?	What Do I Need?
Cloud NGFW for Azure	Cloud NGFW subscription Palo Alto Networks Customer Support Portal account Azure Marketplace subscription

Cloud NGFW uses certificates to enable outbound decryption. These certificates are stored in the Azure Key Vault.

Only self-signed and root CA signed certificates are currently supported for decryption. Chained certificates are not supported.

Strata Cloud Manager

Add a Cloud Certificate to Cloud NGFW for Azure using Strata Cloud Manager.

Select ManageConfigurationNGFW and Prisma Access.
From the Configuration Scope dropdown, select the folder or NGFW for which you want to add a certificate.
Select Device ManagementCertificates.
Click Add.
Enter a descriptive Name for your certificate.
(Optional) Enter a Description for your certificate.
For Cloud Platform, choose Microsoft Azure.
Enter the Key Vault URI for your Azure Key Vault.

To find the Key Vault URI, navigate to your Azure Key Vault resource and copy the Vault URI from the Overview page.
Enter the Secret Name of the certificate stored in your Azure Key Vault.

To find the Secret Name, navigate to Azure Key VaultCertificates and copy the name of your certificate.
Click Save.
Verify that the managed identity assigned to the NGFW has the Key Vault Secrets User role configured in Azure Key VaultAccess Policies.

Add a certificate to Cloud NGFW for Azure using a local rulestack.

To add a certificate, familiarize yourself with how rulestacks work.

Click the Local Rulestacks icon from the homepage and select a previously created rulestack on which you wish to create a certificate.
Click Certificates on the left pane and click Add. The Add Certificate List pane opens.
Enter a descriptive Name for your certificate.
(Optional) Enter a description for your certificate.
If the certificate is self-signed, check Self-Signed Certificate.
If the certificate isn't self-signed, obtain the Certificate URI by navigating to Azure key vaultCertificates and copy-paste the Secret Identifier URI in Certificate URI.
(Optional) In the Certificate source field, choose the respective option: Select from Key vault or Paste URI.
Click Add.
Create a managed identity in the same resource group as the Key Vault. See Create a user-assigned managed identity.
Navigate to Azure Key VaultAccess Policies.
Click Create to configure an access policy that assigns Key Vault Certificates Officer and Key Vault Secrets User to the managed identity created in the previous step.