Strata Copilot
    Next-Gen Trust Security
    : Provision to a Common KeyStore
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security overview
    5. Welcome to installations
    6. About machines
    7. Provision certificates to machines
    8. Provision to a Common KeyStore

    Next-Gen Trust Security

    Provision to a Common KeyStore

    Table of Contents

    Provision to a Common KeyStore

    Use this procedure to provision a certificate from Next-Gen Trust Security to a Common KeyStore machine.
    1. Sign in to Next-Gen Trust Security.
    2. Click Insights > Machines.
    3. Select the Common KeyStore machine you want to provision a certificate to.
    4. Click Provision a certificate.
    5. From Choose a certificate from the inventory, search for and select the certificate you want to provision.
      Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
    6. From KeyStore Type, select one of the following options and complete the required fields.

    PEM

    1. Enter the Certificate Path, Private Key Path, and Certificate Chain Path.
    2. (Optional) In Key Password, enter a password if the private key should be encrypted.
    3. (Optional) In Service Name, enter the name of the service to restart after provisioning.
    4. (Optional) To prevent the certificate from being pushed immediately, set Push upon saving to No.
    5. Click Save.

    JKS

    1. Enter the KeyStore Path, Alias, and Store Password.
    Note:If Append to JKS is enabled and the keystore file already exists, the certificate is added to the existing file.If disabled, a new keystore is created or an existing file is replaced. A backup is created automatically if the file already exists.
    1. (Optional) In Key Password, enter a password if it differs from the store password.
    2. (Optional) In Service Name, enter the name of the service to restart after provisioning.
    3. (Optional) To prevent the certificate from being pushed immediately, set Push upon saving to No.
    4. Click Save.

    PKCS#12

    1. Enter the KeyStore Path.
    2. Enter the Key Password to protect the keystore.
    3. (Optional) In Service Name, enter the name of the service to restart after provisioning.
    4. (Optional) To prevent the certificate from being pushed immediately, set Push upon saving to No.
    5. Click Save.
    After saving, Next-Gen Trust Security provisions the certificate to the Common KeyStore and creates an installation record on the Installations tab.

    © 2026 Palo Alto Networks, Inc. All rights reserved.