>
    Strata Copilot
    Revoke and Renew Certificates
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Certificate Management
    4. Revoke and Renew Certificates
    Download PDF
    Next-Generation Firewall

    Revoke and Renew Certificates

    Table of Contents

    Revoke and Renew Certificates

    Learn how to revoke and renew certificates.

    Revoke a Certificate

    Learn how to revoke a certificate when an NGFW is the certificate authority (CA).
    Various circumstances can invalidate a certificate before the expiration date. Some examples are a change of name, change of association between subject and certificate authority (for example, an employee terminates employment), and compromise (known or suspected) of the private key. Under such circumstances, the certificate authority (CA) that issued the certificate must revoke it. The following task describes how to revoke a certificate for which the firewall is the CA.
    1. Select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later).
    2. If the firewall supports multiple virtual systems, the tab displays a Location drop-down. Select the virtual system to which the certificate belongs.
    3. Select the certificate to revoke.
    4. Click Revoke. PAN-OS immediately sets the status of the certificate to revoked and adds the serial number to the Online Certificate Status Protocol (OCSP) responder cache or certificate revocation list (CRL). You need not perform a commit.

    Renew a Certificate

    Follow these steps to renew a certificate from an external CA or when the firewall is the CA.
    If a certificate expires, or soon will, you can reset the validity period. If an external certificate authority (CA) signed the certificate and the firewall uses the Online Certificate Status Protocol (OCSP) to verify certificate revocation status, the firewall uses the OCSP responder information to update the certificate status (see Configure an OCSP Responder). If the firewall is the CA that issued the certificate, the firewall replaces it with a new certificate that has a different serial number but the same attributes as the old certificate.
    1. Select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later).
    2. If the firewall has more than one virtual system (vsys), select a Location (vsys or Shared) for the certificate.
    3. Select a certificate to renew and click Renew.
    4. Enter a New Expiration Interval (in days).
    5. Click OK and Commit.

    © 2026 Palo Alto Networks, Inc. All rights reserved.