>
    Strata Copilot
    Editing Custom Next-Gen CA Issuance Policies
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Overview: Certificate Issuance
    6. Next-Gen CA
    7. About Next-Gen CA Issuance Policies
    8. Editing Custom Next-Gen CA Issuance Policies
    Next‑Gen Trust Security

    Editing Custom Next-Gen CA Issuance Policies

    Table of Contents

    Editing Custom Next-Gen CA Issuance Policies

    Edit a custom issuance policy to change the limits it sets on certificates that Next-Gen CA issues. Before you submit the change, Next-Gen Trust Security (NGTS) checks request policies that use the issuance policy and shows how the change affects each one.
    You can only edit custom issuance policies. To change the global default issuance policy or a platform template, clone it instead.

    Prerequisites

    To complete these steps, you must have:
    • A Superuser role or a custom role with write access to the Issuance Policies permission set.
    • Request policies that fit your changes. You can't submit an edit that makes a request policy incompatible. For example, if you remove a key algorithm that a request policy uses, you must first edit the request policy to fit. To find Incompatible request policies, start this task and stop at Change Impact, which lists each Incompatible request policy and its fix.

    To Edit a Custom Issuance Policy

    1. Sign in to Next-Gen Trust Security.
    2. Click Configuration > Certificate Policies > Issuance Policies.
    3. On the Next-Gen CA Policies tab, select a custom policy name, and in the right panel, click Edit.
    4. In the Constraints step, change the settings you want.
    5. Click Next.
      NGTS checks each request policy that uses the issuance policy against your changes.
    6. In Change Impact, review how many request policies get each result.
      ResultDescription
      CompatibleThe request policy fits the edited issuance policy, so NGTS issues certificates based on the request policy.
      ClampedNGTS still issues certificates, but changes them to fit the issuance policy. For example, if you lowered the maximum validity, NGTS shortens the validity of the certificates it issues.
      IncompatibleNGTS can't issue any certificates for the request policy. For example, requests under the request policy use a key algorithm that the issuance policy no longer allows.
    7. In Request Policies, review request policies that the change makes incompatible or clamps.
    8. If any request policy is Incompatible, you can't submit the edit. Click Back and change the settings. Or, click Cancel and fix the request policies as described in Prerequisites.
    9. Click Submit.
      NGTS saves the changes and every request policy that uses the issuance policy gets the new limits.

    © 2026 Palo Alto Networks, Inc. All rights reserved.