>
    Strata Copilot
    Next-Gen CA
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Overview: Certificate Issuance
    6. Next-Gen CA
    Next‑Gen Trust Security

    Next-Gen CA

    Table of Contents

    Next-Gen CA

    Next-Gen CA in Next-Gen Trust Security (NGTS) is a private, cloud-hosted public key infrastructure (PKI) that you can use to issue certificates without maintaining your own infrastructure.
    Next-Gen CA provides the following key benefits:
    • Protects Production certificate authority (CA) keys in hardware because Production tier PKIs store keys in a hardware security module (HSM) certified to FIPS 140-3 Level 3.
    • Checks every request against your standards so every certificate meets the cryptographic and identity requirements you set in an issuance policy.
    • Offers multi-person approval for changes to a PKI through Quorum, which guards against errors or misuse.
    • Issues post-quantum certificates signed with the Module-Lattice-Based Digital Signature Algorithm (ML-DSA), defined in FIPS 204, so you can prepare your applications for the post-quantum transition.
    • Signs CA certificates for Distributed Issuer and Forward Trust Proxy so their certificates chain to your organization's PKI. Select Next-Gen CA when you add a subordinate CA provider.
    • Works with existing NGTS features so you can issue certificates through request policies, use enrollment protocols such as ACME and SCEP, and track certificates in the certificate inventory.
    By using Next-Gen CA, your organization can issue privately trusted certificates immediately and validate your PKI configuration in NGTS.

    Next Steps

    To start learning how Next-Gen CA works, see About the PKI Hierarchy. To set up Next-Gen CA and request your first certificate, see Getting Started with Next-Gen CA.

    © 2026 Palo Alto Networks, Inc. All rights reserved.