Generate Certificate (Strata Cloud Manager)

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessObjectsCertificate ManagementConfigurationNGFW and Prisma AccessObjectsCertificate Management.
3. In the Custom Certificates pane, click Generate.
4. Enter a Certificate Name. The name is case-sensitive and can have up to 63 characters. It must be unique and use only letters, numbers, hyphens, and underscores.
5. For Common Name, enter the FQDN (recommended) or IP address of the interface where you will configure the service that uses this certificate.
6. For Signed By, select the root CA certificate that will issue the certificate.
7. Configure the Cryptographic Settings.

   1. Select a key generation Algorithm: RSA (default) or Elliptic Curve DSA (ECDSA). ECDSA is recommended for client browsers and operating systems that support it.

      • RSA (default)
      • Elliptic Curve DSA (ECDSA)
        ECDSA is recommended for client browsers and operating systems that support it.
      • (PAN-OS 12.1 only) ML-DSA
      • (PAN-OS 12.1 only) SLH-DSA

      Hardware security modules (HSMs) cannot be used to store private ECDSA keys used for SSL Forward Proxy or SSL Inbound Inspection.
   2. (PAN-OS 12.1 only) For SLH-DSA only, select Algorithm Parameters for the hash-based signature scheme.

      The parameters reflect the hashing algorithm (sha or SHAKE), NIST security level (128 bits, 192 bits, or 256 bits of security), and the digital signature size of the scheme.
   3. Select the Number of Bits to define the certificate key length.

      Higher numbers are more secure but require more processing time.

      SLH-DSA bits are preselected based on the selected Algorithm Parameters.

      • For RSA, select 512 bits, 1024 bits, 2048 bits, 3072 bits, or 4096 bits.
        If the NGFW is in FIPS-CC mode, the RSA keys generated must be either 2048 or 3027 bits.
      • For ECDSA, select either 256 bits or 4096 bits.
      • (PAN-OS 12.1 only) For ML-DSA, select 10496 bits, 15616 bits, or 20736 bits.
   4. Select a Digest algorithm.

      From most to least secure, the options are: sha512, sha384, sha256 (default), sha1, and md5.

      • For RSA, select md5, sha1, sha256, sha384, or sha512.
        If the NGFW is in FIPS-CC mode, you must select sha256, sha384, or sha512.
      • For Elliptic Curve DSA, select either sha256 or sha384.
      • (PAN-OS 12.1 only) For ML-DSA and SLH-DSA, select sha256, sha384, or sha512.

      Client certificates that are used when requesting firewall services that rely on TLSv1.2 (such as administrator access to the web interface) cannot have sha512 as a digest algorithm. The client certificates must use a lower digest algorithm (such as sha384) or you must limit the Max Version to TLSv1.1 when you configure SSL/TLS service profiles for the firewall services.
   5. For Expiration, enter the number of days (default is 365) for which the certificate is valid.
8. (Optional) Add Certificate Attributes to uniquely identify the firewall and the service that will use the certificate.

   If you add a Host Name (DNS name) attribute, match it to the Common Name, because the hostname populates the Subject Alternate Name (SAN) field of the certificate and some browsers require the SAN to specify the domains the certificate protects; in addition, the Host Name matching the Common Name is mandatory for GlobalProtect.
9. (Optional) Select an OCSP Responder.
10. Save the certificate.

    The certificate displays in the Custom Certificates list.