Import a Certificate and Private Key

From the enterprise CA, export the certificate and private key that the firewall will use for authentication.
When exporting a private key, you must enter a passphrase to encrypt the key for transport. Ensure the management system can access the certificate and key files. When importing the key onto the firewall, you must enter the same passphrase to decrypt it.
Select
Device
Certificate Management
Certificates
Device Certificates
.
If the firewall has more than one virtual system (vsys), select a
Location
(vsys or
Shared
) for the certificate.
Click
Import
and enter a
Certificate Name
. The name is case-sensitive and can have up to 63 characters on the firewall or up to 31 characters on Panorama. It must be unique and use only letters, numbers, hyphens, and underscores.
To make the certificate available to all virtual systems, select the
Shared
check box. This check box appears only if the firewall supports multiple virtual systems.
Enter the path and name of the
Certificate File
received from the CA, or
Browse
to find the file.
Select a
File Format
:
Encrypted Private Key and Certificate (PKCS12)
—This is the default and most common format, in which the key and certificate are in a single container (
Certificate File
). If a hardware security module (HSM) will store the private key for this certificate, select the
Private key resides on Hardware Security Module
check box.
Base64 Encoded Certificate (PEM)
—You must import the key separately from the certificate. If a hardware security module (HSM) stores the private key for this certificate, select the
Private key resides on Hardware Security Module
check box and skip the next step. Otherwise, select the
Import Private Key
check box, enter the
Key File
or
Browse
to it, then continue to the next step.
(
Panorama managed firewalls
) You are required to
Import Private Key
if you enabled
Block Private Key Export
when the certificate was generated to successfully push configuration changes from the Panorama management server to managed firewalls.
Enter and re-enter (confirm) the
Passphrase
used to encrypt the private key.
Click
OK
. The Device Certificates page displays the imported certificate.