Configure an SSL/TLS Service Profile (Strata Cloud Manager)

1. Log in to Strata Cloud Manager.
2. For each desired service, generate or import a certificate.

   1. Select ConfigurationNGFW and Prisma AccessObjectsCertificate Management.
   2. In the Custom Certificates pane, Generate or Import a certificate.
   3. Save the certificate.
3. Configure an SSL/TLS service profile.

   1. Select ConfigurationNGFW and Prisma AccessObjectsCertificate Management.
   2. In the SSL/TLS Service Profiles pane, click Add Profile.
   3. Enter a Name for the profile.
   4. Select or Import a Certificate.

      PQC certificates are not available for selection or import.
   5. For Protocol Settings, define the range of TLS versions that the service can use.

      TLSv1.3 support is limited to administrative access to management interfaces and GlobalProtect portals and gateways. You can only attach SSL/TLS service profiles that allow TLSv1.3 to the settings for these services.

      Administrative Access and GlobalProtect Portals and Gateways:

      Set the Min Version and Max Version to TLSv1.3.

      • For the Min Version, select the earliest allowed TLS version: TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3.
      • For the Max Version, select the latest allowed TLS version: TLSv1.0, TLSv1.1, TLSv1.2, or TLSv1.3.

      All Other Services:

      Set the Min Version and Max Version to TLSv1.2.

      • For the Min Version, select the earliest allowed TLS version: TLSv1.0, TLSv1.1, or TLSv1.2.
      • For the Max Version, select the latest allowed TLS version: TLSv1.0, TLSv1.1, or TLSv1.2.
4. (Optional) Select or clear Key Exchange Algorithms, Encryption Algorithms, or Authentication Algorithms.

   Starting in PAN-OS 12.1.2, you can enable post-quantum key exchange algorithms for TLSv1.3 sessions. You must enable TLSv1.3 in the Protocol Settings.

   To configure Key Exchange Algorithms, select the algorithm type:

   • For classical algorithms (RSA, DHE, or ECDHE): Select the Classical tab, and then select or clear algorithms.
     By default, RSA, DHE, and ECDHE are enabled.
   • (TLSv1.3 only) For PQC algorithms:
     1. Select the Post Quantum Cryptography (PQC) tab, and then click Add.
     2. For Algorithm, select ML-KEM (Module-Lattice-based Key Encapsulation Mechanism).
     3. Select at least one Security Level:
        Each security level corresponds to one of three ML-KEM parameter sets specified in FIPS 203. Higher security levels offer greater protection but reduced performance.
        • Level 1—ML-KEM-512
        • Level 3—ML-KEM-768
        • Level 5—ML-KEM-1024
     4. Select one or more PQC Supported Groups.
        The available curve groups change based on Algorithm and Security Level. You can generate session keys using post-quantum or hybrid post-quantum key exchange. Hybrid key exchange pairs Elliptic Curve Cryptography (ECC) with ML-KEM to protect against both classical and quantum threats. The following curves are supported for hybrid key agreement: x25519, x448, p256, p384, and p512.
     5. Save the PQC algorithms.
5. Save the profile.
6. To commit your changes, click Push ConfigPush.