Strata Copilot
    Next-Gen Trust Security
    : Working with tags in the certificate inventory
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security overview
    5. Start with the TLS Certificates dashboard
    6. Tagging certificates
    7. Working with tags in the certificate inventory

    Next-Gen Trust Security

    Working with tags in the certificate inventory

    Table of Contents

    Working with tags in the certificate inventory

    Tagging helps you group and manage related certificates. You can centrally manage tags on the Configurations > Tags page. You can also assign, modify, and clear tags directly from the certificate inventory.

    Assign tags to existing certificates

    1. Open the certificate inventory by going to Inventory > Certificates.
    2. Select the certificates you want to tag.
    3. In the local menu bar, click Tag > Add Tags.
    4. Click in the Tags field and select existing tags, or enter a new tag or key:value pair.
      Note (When creating new tags):
      • Creating a key:value pair also creates a standalone tag for the key value.
      • Tag names cannot be changed or deleted using the UI after creation.
      • You can create multiple values for the same key.
    5. Optional: Select Replace current tag assignments to replace existing tags.
    6. Click Save.
    After tags are applied, they appear in the Tags section of the certificate details and in the Tags column of the inventory. Tags are retained when you renew a certificate.

    Change tags on a certificate

    You can update tags for a single certificate or for multiple certificates at once.

    Change tags on a single certificate

    1. Open the certificate inventory by going to Inventory > Certificates.
    2. Select the certificate whose tags you want to change.
    3. In the local menu bar, click Tag > Add Tags.
    4. Remove existing tags by selecting the delete icon next to each tag.
    5. Add or update tag assignments. Keep in mind that a certificate can have a maximum of 20 tags.
    6. Click Save.

    Modify tag values on a single certificate

    1. Open the certificate inventory by going to Inventory > Certificates.
    2. Select the certificate whose tag values you want to edit.
    3. In the local menu bar, click Tags > Edit Tags.
    4. Edit the tag values.
    5. Click Save.

    Change tags on multiple certificates

    1. Open the certificate inventory by going to Inventory > Certificates.
    2. Select the certificates you want to update.
    3. In the local menu bar, click Tag > Add Tags.
    4. Add or select tag assignments.
    5. Optional: Select Replace current tags to overwrite existing tags.
      Note:
      • If adding tags causes a certificate to exceed the 20-tag limit, that certificate is skipped.
      • If all selected certificates exceed the limit, the operation fails.
    6. Click Save.

    Clear all tags from certificates

    1. Open the certificate inventory by going to Inventory > Certificates.
    2. Select the certificates whose tags you want to clear.
    3. In the local menu bar, click Tag > Clear Tags.
    4. Confirm by clicking Clear.
    Clearing tags removes all tag assignments from the selected certificates but does not delete the tags themselves. Tags remain available to be reused.

    Filter certificates by tags

    After assigning tags, you can filter the certificate inventory by tag. Select Tag from the Add Criteria dropdown, and then choose the tags to filter on.
    Next-Gen Trust Security includes a system tag named Venafi, which cannot be modified, assigned, removed, or deleted.

    © 2026 Palo Alto Networks, Inc. All rights reserved.