Strata Copilot
    Next-Gen Trust Security
    : Retiring, Recovering, and Deleting Certificates
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Start with the TLS Certificates Dashboard
    6. Retiring, Recovering, and Deleting Certificates

    Next-Gen Trust Security

    Retiring, Recovering, and Deleting Certificates

    Table of Contents

    Retiring, Recovering, and Deleting Certificates

    Next-Gen Trust Security lets you retire certificates that are no longer in use. Retired certificates are removed from active inventory but kept temporarily so you can recover them if needed.

    What Does “retire” Mean?

    Retiring a certificate moves it out of the active Certificate Inventory and into a temporary holding state. Retired certificates:
    • Are not monitored
    • Can be recovered during the retention period
    After the retention period ends, retired certificates are permanently deleted.

    Retire a Certificate

    1. Sign in to Next-Gen Trust Security.
    2. Click Insights > Certificate Inventory > Certificates.
    3. On the Server or Client tab, find the certificate you want to retire.
    4. Select the checkbox next to each certificate you want to retire, and then click More > Retire.To retire a single certificate, you can also open its details and click Retire.
    5. Optional: For a certificate on the Server tab, to keep future network discovery scans from finding the certificate again, select Do not rediscover this certificate.
      Note: The Do not rediscover this certificate option applies only to network discovery. It does not affect machine, keystore, Kubernetes, or other types of discovery.
    6. Click Retire.
    7. To view retired certificates, change the view to Retired certificates.

    Recover a Retired Certificate

    1. Click Insights > Certificate Inventory > Certificates.
    2. On the Server or Client tab, change the view to Retired certificates.
    3. Find the certificate you want to recover.
    4. Select the certificate, and then click Recover.You can recover one certificate at a time.
    5. Click Recover to confirm.
    The certificate is returned to the active inventory.

    Delete a Certificate Permanently

    Retired certificates are automatically deleted after the configured retention period.You can also delete a retired certificate immediately.
    To delete a certificate permanently:
    1. Click Insights > Certificate Inventory > Certificates.
    2. On the Server or Client tab, change the view to Retired certificates.
    3. Select the certificates you want to delete, and then click Delete Forever.To delete a single certificate, you can also open its details and click Delete Forever.
    4. Click Delete to confirm.
    Once deleted, the certificate cannot be recovered.

    © 2026 Palo Alto Networks, Inc. All rights reserved.