>
    Strata Copilot
    Working with Custom CA Connectors in the Certificate Authorities Inventory
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Overview: Certificate Issuance
    6. Adding a Certificate Authority
    7. Create a Custom Certificate Authority (CA)
    8. Working with Custom CA Connectors in the Certificate Authorities Inventory
    Next‑Gen Trust Security

    Working with Custom CA Connectors in the Certificate Authorities Inventory

    Table of Contents

    Working with Custom CA Connectors in the Certificate Authorities Inventory

    When working with the custom CA connectors, there are several things you can do. This topic discusses several features of custom CA connectors.
    Tip: Before you begin - You need to have created a custom CA connector before the information in this topic will be useful.
    You can find existing custom CA connectors in Next-Gen Trust Security by going to Configuration > Certificate Integrations > Certificate Authorities, and then reviewing the list to find CAs with the subtitle Connector CA.
    The details panel for a custom CA connector has four tabs corresponding to the wizard's four steps that you used to create the CA connector.
    • The Administration tab lets you change the name of the connector and which VSatellite it uses for connection.
    • The Information tab controls how Next-Gen Trust Security connects to your CA account.
    • The Issuance tab controls how certificates are created by your custom CA.
    • The Import tab controls the settings used to import certificates from the CA.

    To Use New Product Options from Your CA

    If new product options become available in your CA account, you can use them in Next-Gen Trust Security without re-creating the CA connector. Each time you open a CA connector from the Certificate Authorities list, Next-Gen Trust Security retrieves the current product list from your CA and uses it to populate Product Options on the Issuance and Import tabs.
    Tip: Before you begin - Make sure the new product is available to the account that Next-Gen Trust Security uses to connect to your CA. For example, in Sectigo Certificate Manager, a new certificate profile doesn't appear until you delegate it.
    1. Locate the CA connector in the Certificate Authorities list and click it.
      If the details panel was already open when the product was added at your CA, close the panel and open it again.
    2. Click the Issuance tab.
    3. In Product Options, select the new product, and then click Add.
    4. (Optional) To import certificates issued with the new product, click the Import tab, select the product in Product Options, and then click Add.
    5. Click Save.
    Retrieving the current product list doesn't change the product options you've already selected. To let users request certificates with the new product, edit the request policies that use this CA connector.

    To Run a Certificate Import Manually

    1. Locate the custom CA connector in the Certificate Authorities list.
    2. Click the Import tab.
    3. Review the existing import settings, and make changes, if needed.
    4. Click Import.

    To Schedule a Certificate Import

    1. Locate the custom CA connector in the Certificate Authorities list.
    2. Click the Import tab.
    3. Enable the Scheduled import setting and set the schedule.
    4. Enter the UTC time when you want the import to occur. For reference, the current UTC time is displayed.
      Tip: When selecting the Month option - If you select the Month option, you will specify the day of the month to run the import. If you select a value like 31, the job will only run on months with the specified number of days and will not run on months without.
    5. Click Save.

    © 2026 Palo Alto Networks, Inc. All rights reserved.