>
    Strata Copilot
    Change Certificates
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Configure Authentication Using Custom Certificates
    4. Change Certificates
    Download PDF
    Panorama

    Change Certificates

    Table of Contents

    Change Certificates

    Replace your custom certificate if it has expired or been revoked.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama)
    • Panorama superuser role
    If a custom certificate in your deployment has expired or been revoked and needs to be replaced, you can complete one of the tasks below.

    Change a Server Certificate

    Complete the following task to replace a server certificate.
    1. Deploy the new server certificate.
      You can deploy certificates on Panorama or a server Log Collector by generating a self-signed certificate on Panorama or obtaining a certificate from your enterprise CA or a trusted third-party CA.
    2. Change the certificate in the SSL/TLS Service Profile.
      1. Select PanoramaCertificate ManagementSSL/TLS Service Profile and select the SSL/TLS service profile.
      2. Select the Certificate.
      3. Click OK.
    3. Reestablish the connection between the server (Panorama or a Log Collector) and client devices.
      1. Select PanoramaSetupManagement and Edit the Panorama Settings for Panorama or select PanoramaManaged CollectorsAddCommunication for a Log Collector.
      2. Set the Disconnect Wait Time.
      3. Click OK.
      4. Commit your changes.

    Change a Client Certificate

    Complete the following task to replace a client certificate.
    1. Obtain or generate the device certificate.
      You can deploy certificates on Panorama or a server Log Collector by generating a self-signed certificate on Panorama or obtaining a certificate from your enterprise CA or a trusted third-party CA.
      Set the common name to $UDID or subject to CN=$UDID (in the SCEP profile) if authorizing client devices based on serial number.
      • You can generate a self-signed certificate on Panorama or obtain a certificate from your enterprise CA or a trusted third-party CA.
      • If you are using SCEP for the device certificate, configure a SCEP profile. SCEP allows you to automatically deploy certificates to managed devices. When a new client devices with a SCEP profile attempts to authenticate with Panorama, the certificate is sent by the SCEP server to the device.
    2. Change the certificate in the certificate profile.
      1. Select DeviceCertificate ManagementCertificate Profile and select the certificate profile.
      2. Under CA Certificates, Add the new certificate to assign to the certificate profile.
      3. Click OK.
      4. Commit your changes.

    Change a Root or Intermediate CA Certificate

    Complete the following task to replace a root or intermediate CA certificate.
    1. Configure the server to accept predefined certificates from clients.
      1. Select PanoramaSetupManagement and Edit the Panorama Settings.
      2. Uncheck Custom Certificate Only.
      3. Select None from the Certificate Profile drop-down.
      4. Click OK.
      5. Commit your changes.
    2. Deploy the new root or intermediate CA certificate.
      You can deploy certificates on Panorama or a server Log Collector by generating a self-signed certificate on Panorama or obtaining a certificate from your enterprise CA or a trusted third-party CA.
    3. Update the CA certificate in the server certificate profile.
      1. Select PanoramaCertificate ManagementCertificate Profile and select the certificate profile to update.
      2. Delete the old CA certificate.
      3. Add the new CA Certificate.
      4. Click OK.
    4. Generate or import the new client certificate.
      1. Select DeviceCertificate ManagementCertificates.
      2. Create a self-signed root CA certificate or import a certificate from your enterprise CA.
    5. Update the CA certificate in the client certificate profile.
      1. Select DeviceSetupManagement and click the Edit icon in Panorama Settings for a firewall or Select PanoramaManaged CollectorsAddCommunication for a Log Collector and select the certificate profile to update.
      2. Delete the old CA certificate.
      3. Add the new CA Certificate.
      4. Click OK.
    6. After updating the CA certificates on all managed devices, enforce custom-certificate authentication.
      1. Select PanoramaSetupManagement and Edit the Panorama Settings.
      2. Select Custom Certificate Only.
      3. Click OK.
      4. Commit your changes.
        After committing this change, all devices managed by Panorama must use custom certificates. If not, authentication between Panorama and the device fails.

    © 2026 Palo Alto Networks, Inc. All rights reserved.