Configure an SSL/TLS Service Profile (PAN-OS & Panorama)

1. For each desired service, generate or import a certificate on the firewall (see Obtain Certificates).

   Use only signed certificates, not CA certificates, in SSL/TLS service profiles.
2. Select DeviceCertificate ManagementSSL/TLS Service Profile, and then click Add.
3. Enter a Name for the profile.
4. If the firewall has more than one virtual system (vsys), select the Location (vsys or Shared) where the profile is available.
5. Select the Certificate you obtained in step one.

   PQC certificates are not available for selection.
6. Under Protocol Settings, define the range of TLS versions the service can use.

   TLSv1.3 support is limited to administrative access to management interfaces and GlobalProtect portals and gateways. You can only attach SSL/TLS service profiles that allow TLSv1.3 to the settings for these services.

   • Administrative Access and GlobalProtect Portals and Gateways:
     Set the Min Version and Max Version to TLSv1.3.
     • For Min Version, select the earliest allowed TLS version: TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3.
     • For Max Version, select the latest allowed TLS version: TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3.
   • All Other Services:
     Set the Min Version and Max Version to TLSv1.2.
     • For the Min Version, select the earliest allowed TLS version: TLSv1.0, TLSv1.1, or TLSv1.2.
     • For the Max Version, select the latest allowed TLS version: TLSv1.0, TLSv1.1, or TLSv1.2.
7. (Optional) Configure Key Exchange Algorithms, Encryption Algorithms, and Authentication Algorithms.

   Starting in PAN-OS 12.1.2, you can enable post-quantum key exchange algorithms for TLSv1.3 sessions. You must enable TLSv1.3 in the Protocol Settings.

   • To configure classical key exchange algorithms (RSA, DHE, and ECDHE):
     By default, RSA, DHE, and ECDHE are enabled.
     • (PAN-OS 11.2 and earlier) Enable or disable algorithms as needed.
     • (PAN-OS 12.1.2 and later) Select the Classical tab, and then enable or disable algorithms as needed.
   • (PAN-OS 12.1.2 and later) To specify PQC key exchange algorithms for TLSv1.3 sessions:
     1. Select the Post-quantum Cryptography (PQC) tab, and then click Add.
     2. For Algorithm, select ML-KEM (Module-Lattice-based Key Encapsulation Mechanism).
     3. For each algorithm, select at least one Security Level:
        Each security level corresponds to one of three ML-KEM parameter sets specified in FIPS 203. Higher security levels offer greater protection but reduced performance.

        • Level 1—ML-KEM-512
        • Level 3—ML-KEM-768
        • Level 5—ML-KEM-1024
     4. For each algorithm, select one or more PQC Supported Groups.
        The available curve groups change based on Algorithm and Security Level. You can generate session keys using post-quantum or hybrid post-quantum key exchange. Hybrid key exchange pairs Elliptic Curve Cryptography (ECC) with ML-KEM to protect against both classical and quantum threats. The following curves are supported for hybrid key agreement: x25519, x448, p256, p384, and p512.
8. Click OK and Commit your changes.