Sign in to Next-Gen Trust Security.
Click Insights > Certificate Installations > Machines.
Click New, and then select Palo Alto Panorama.
On the Properties step, in Name, enter a name for the machine.
(Optional) For
Authorized Workspaces, choose the workspaces to share the machine with. Sharing is supported for machines that use credentials you enter directly. To learn what other workspaces can do with a shared machine, see
Sharing Makes a Resource Visible Elsewhere.
For VSatellite, choose a VSatellite that can reach the machine. The list shows each VSatellite with the number of its active replicas.
In Server Hostname, enter the hostname or IP address of Panorama.
For Credential Type, choose how to provide the credentials:
Enter Credentials to enter the credentials in the next step. This is the default.
Select Credentials to use credentials stored in a credential manager integration. Then, for Credential, choose the credential.
Note: Select Credentials requires a configured credential manager integration. Credential manager integrations require additional licensing.
Important: Your view of credentials depends on the workspace you have selected. Under Tenant you can select any credential in the tenant. Inside a workspace you can select only that workspace's credentials.
If you chose Enter Credentials, enter the Username and Password of the Panorama administrator. If you chose Select Credentials, the stored account needs the same Panorama access.
Note: Next-Gen Trust Security encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.
Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.
Note: A successful test confirms that Panorama accepts the credentials and that the appliance is a Panorama in Panorama or Management Only mode. It doesn't check the administrator's XML API privileges.
(Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.
(Optional) In Location(s), enter a comma-separated list of the locations to discover, for example Shared, vsys1, vsys2. Leave it empty to discover every location.
Shared, in any case, covers the Shared location of each template and template stack, and Panorama's own configuration. To discover only these, enter Shared alone.
A virtual system (vsys) name covers that vsys in every template that has it. Vsys names are case-sensitive, as they are in PAN-OS. A list of vsys names alone skips template stacks and Panorama's own configuration, which have no vsys.
The list limits which certificates discovery reports, not where it looks up bindings. Discovery still reports a certificate in a listed location with its bindings from unlisted locations, for example a template's Shared certificate that a profile in an unlisted vsys uses.
(Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
Click Continue. The Provisioning step opens.
(Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).
Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.
Click Finish.
