>
    Strata Copilot
    Provision to Palo Alto Networks Prisma Access
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Welcome to Installations
    6. About Machines
    7. Create a Palo Alto Networks Prisma Access Machine
    8. Provision to Palo Alto Networks Prisma Access
    Next‑Gen Trust Security

    Provision to Palo Alto Networks Prisma Access

    Table of Contents

    Provision to Palo Alto Networks Prisma Access

    Provision a certificate from Next-Gen Trust Security to a Palo Alto Networks Prisma® Access tenant. Next-Gen Trust Security imports the certificate into a Strata Cloud Manager folder as a new certificate object, points a TLS service profile or IKE gateway at it, and pushes the configuration.
    Warning: To publish a binding change, Next-Gen Trust Security pushes the candidate configuration of the affected Strata Cloud Manager folders. The push also publishes every other pending change in those folders, including changes that other administrators haven't pushed yet. Before you provision or schedule provisioning, coordinate with the other Strata Cloud Manager administrators of the tenant.

    Before You Begin

    • A Prisma Access machine that you created and whose status is Verified.
    • The certificate to provision in the Next-Gen Trust Security inventory, with its private key. Next-Gen Trust Security can't install a certificate without its private key.
    • A Superuser role or a custom role with write access to the Provisioning permission set, which is under the Machines permission set.
    • The name and the folder or snippet of the TLS service profile or IKE gateway that you want to bind the certificate to. An IKE gateway must authenticate with a certificate, not a pre-shared key.

    To Provision a Certificate to Palo Alto Networks Prisma Access

    1. Sign in to Next-Gen Trust Security.
    2. Click Insights > Certificate Installations > Machines.
    3. Click the more options button at the end of the machine's row, and then select Provision.
    4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.
      The rest of the Provision a certificate dialog appears after you select a certificate.
    5. Under Certificate Information, in Certificate Name, enter the base name for the certificate object in Strata Cloud Manager, or leave (unset) to derive the name from the certificate's common name.
      Next-Gen Trust Security cuts the base name to 20 characters, removes any spaces, hyphens (-), underscores (_), or periods (.) that the cut leaves at the end, and adds -vc and an 8-character hash of the certificate. For example, branch-office-vpn-certificate becomes branch-office-vpn-ce-vc followed by the hash. In a name derived from the common name, every character other than a letter, digit, space, hyphen, underscore, or period becomes an underscore. Because the hash comes from the certificate, every renewal creates a new certificate object, and installing the same certificate again reuses the existing object.
    6. In Certificate Folder, replace the default, Shared, if you want to import the certificate into a different Strata Cloud Manager folder, such as Mobile Users, Remote Networks, or Service Connections.
      Note: The object that uses the certificate must be able to see this folder, so enter the object's own folder or a folder above it, such as Shared. Next-Gen Trust Security imports certificates only into folders, not into snippets or onto devices. If discovery found the certificate in a snippet or on a device, change Certificate Folder to a folder before you provision.
    7. Leave Certificate Object and Superseded Certificate Object as they are. They're read-only. Next-Gen Trust Security fills in Certificate Object with the certificate object that holds the installed certificate. When you renew a certificate, it fills in Superseded Certificate Object with the certificate object that the new certificate replaces.
    8. Under Installation Endpoint, for Object Type, choose the kind of object that uses the certificate:
      • TLS Service Profile: a TLS service profile, such as one that a GlobalProtect portal or gateway uses. The portals and gateways that use the profile pick up the new certificate.
      • IKE Gateway: an IKE gateway of a Remote Network or Service Connection IPsec tunnel. The gateway must authenticate with a certificate, not a pre-shared key.
      • Not Bound: imports the certificate without changing any configuration. This is the default.
    9. In Object Name, enter the name of the TLS service profile or IKE gateway. If you chose Not Bound, leave (unbound), including the parentheses.
    10. In Object Folder or Snippet, enter the folder or snippet that defines the object. A folder that only inherits the object doesn't count. Next-Gen Trust Security pushes the change to that folder, or to every folder that the snippet is attached to. The default is Shared.
      Note: Next-Gen Trust Security can't configure an object that's defined on a device, or an object in a snippet that isn't attached to any folder, because it can't push either change.
    11. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
    12. Click Save. To save and then provision another certificate, click Save & New.
    After you save, Next-Gen Trust Security imports the certificate, its private key, and its chain into the certificate folder as a new certificate object. It then points the TLS service profile or IKE gateway at the new object, reads the object back to confirm the change, and pushes the configuration. Next-Gen Trust Security waits up to 4 minutes for the push job to finish. With Not Bound, Next-Gen Trust Security only imports the certificate. An installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.
    When you renew a certificate, Next-Gen Trust Security deletes the superseded certificate object after it rebinds the TLS service profile or IKE gateway, and pushes the deletion. It deletes the object only if all of these are true:
    • Next-Gen Trust Security created the object. Its name ends in -vc and a hash.
    • The object is in the certificate folder itself.
    • Nothing references the object anymore.
    Next-Gen Trust Security never deletes an object when the installation's object type is Not Bound.
    Note: If Next-Gen Trust Security can't delete the superseded object, it leaves the object in place and logs a warning. The provisioning still succeeds. You can delete the old object in Strata Cloud Manager yourself.

    © 2026 Palo Alto Networks, Inc. All rights reserved.