>
    Strata Copilot
    About Configuration Tiers
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Overview: Certificate Issuance
    6. Next-Gen CA
    7. About Configuration Tiers
    Next‑Gen Trust Security

    About Configuration Tiers

    Table of Contents

    About Configuration Tiers

    A configuration tier is the Next-Gen CA environment that a public key infrastructure (PKI) configuration belongs to. Choose a tier for each certificate authority (CA) you create. The tier defines how Next-Gen Trust Security (NGTS) protects the CA's keys and which rules its CAs must follow.
    Next-Gen CA has a Test tier and a Production tier. On the Certificate Authorities page, Next-Gen CAs has a Test Environment tab and a Production Environment tab.

    Test Tier

    NGTS creates the Test tier with a default PKI hierarchy when it sets up your tenant. Use it to try out certificate lifecycle management in a sandbox environment.
    The Test tier has these limits:
    • CA names: Each CA's common name (CN) must include the word "Test".
    • Validity periods: NGTS sets fixed validity periods of 6 years for root CAs and 3 years for issuing CAs.
    • Key storage: NGTS stores CA keys in software, not in an HSM.

    Production Tier

    The Production tier holds your production PKI. NGTS creates its CA keys in a hardware security module (HSM) certified to FIPS 140-3 Level 3, and you can't export them.
    The exception is post-quantum Module-Lattice-Based Digital Signature Algorithm (ML-DSA) CA keys, which NGTS doesn't generate in the HSM yet. Each ML-DSA key is stored in software validated to FIPS 140-3, and encrypted with a key that NGTS generates in the HSM.
    Note: HSM support for the Production tier is not available in all regions yet. If the Production Environment tab is unavailable, contact your Palo Alto Networks representative.

    Issuance Policies and Quorum

    Each custom issuance policy belongs to one tier and works only with CAs in that tier. You can't change a policy's tier, but you can clone a Test tier policy to Production.
    You can set up Quorum in either tier. With Quorum enabled, changes need approval before they apply. Without it, they apply immediately.

    © 2026 Palo Alto Networks, Inc. All rights reserved.