>
    Strata Copilot
    Create a Sectigo Certificate Manager (VSatellite) Configuration
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Overview: Certificate Issuance
    6. Adding a Certificate Authority
    7. Create a Custom Certificate Authority (CA)
    8. Create a Sectigo Certificate Manager (VSatellite) Configuration
    Next‑Gen Trust Security

    Create a Sectigo Certificate Manager (VSatellite) Configuration

    Table of Contents

    Create a Sectigo Certificate Manager (VSatellite) Configuration

    Next-Gen Trust Security supports integration with Sectigo Certificate Manager (VSatellite), allowing you to manage certificate issuance, import existing certificates, and revoke certificates through your Sectigo Certificate Manager CA account.

    Before you begin

    Prerequisites:
    • You must have the Superuser role in Next-Gen Trust Security to create CA connectors.
    • A deployed VSatellite that can resolve the Sectigo service address to an IP address. Learn more about VSatellite
    As a Sectigo administrator, ensure your account has the following settings:
    • Admin type: Select API
    • An API key
    • Certificate requests: Select Automatically approve certificate requests under Edit Standard Admin
    For more information on managing your Sectigo administrator accounts, see Managing administrators.

    Create the Sectigo Certificate Manager (VSatellite) configuration in Next-Gen Trust Security

    Before you complete these steps, be sure to read the entire Create custom CA connector topic, including the pre-requisites and notes.
    1. Click Configuration > Certificate Integrations > Certificate Authorities.
    2. Click the New button, then click Add Certificate Authority connector.
    3. Specify the Connection information.
      1. Enter a Name that will be used as the display name for the CA connector you are creating.
      2. Select the VSatellite that can resolve the hostname to the IP address of your Sectigo CA server.
      3. Select Sectigo Certificate Manager (VSatellite) as the Certificate Authority Type.
      4. Click Next.
    4. Provide the Information needed to connect to your Sectigo account.
      1. In the Service Address field, enter the URL for the Sectigo CA server.
        For example: cert-manager.com
        If you have a custom URL associated with your account, you can enter it here.
      2. Enter your Customer URI.
        This is the last part of your Web Admin Console URL.
        Example: If your Web Admin Console were https://cert-manager.com/customer/MyCustomerName, your Customer URI would be MyCustomerName.
      3. Enter your Username and Password you use to log in to your Sectigo account.
      4. Click Test Connection to verify that VSatellite can test the connection to your account. When VSatellite has connected to Sectigo you will see a confirmation box with a green check mark, and a message that the connection was successful.
      5. Click Next.
    5. Specify the Issuance options by specifying the product offerings to include.
      1. In Product Options, select the products you want to use on an issuing template.
        How do I know which product options to select? In this step, we recommend you select all products that you might want to use with Next-Gen Trust Security. You can restrict which products are available when you create the issuing template. Selecting them here makes them available for issuing templates that use this CA connector. You can easily modify this at a later point by editing the CA connector settings.
      2. Click Add.
        It's easy to miss this step, so be careful. You want to see all the selected product options visible in the Name box before you continue.
      3. Click Next.
    6. (Optional) Specify the Import settings.
      The rest of these steps are to set up the import of certificates, which is optional. If you don't want to set up import steps, click Create.
      1. In the Import options section, specify if you want to include revoked or expired certificates.
      2. To schedule importing certificates from Sectigo server, enable the Scheduled import option, then select the scheduling options.
        Tip: Selecting a scheduled import frequency - When you import certificates from Sectigo, the Sectigo API does not allow you to filter the import to only download updates, so every import will import the entire inventory of certificates in your account. This may be a significant number, especially if you include revoked or expired certificates. Because this can take a significant amount of time, you may want to decrease the frequency of your scheduled import. Many customers have found that a weekly scheduled import is sufficient.
      3. Click Create.
    You will see your new Sectigo CA in the Certificate Authority list.

    What's next?

    Now that you have created a new CA connector, you need to create an issuing template that uses this new CA connector.
    Once you have created an issuing template, users in your TSG can begin requesting certificates using this CA connector. If you want to share the issuing template with child TSGs, you can do so from the issuing template settings.

    © 2026 Palo Alto Networks, Inc. All rights reserved.