Add New Client Devices

If the Custom Certificates Only is not selected on Panorama, you can add the device to Panorama and then deploy the custom certificate by following the process beginning in step Configure Authentication Using Custom Certificates on Managed Devices.
If the Custom Certificates Only is selected on Panorama, you must deploy the custom certificates on the firewall before adding it to Panorama. If not, the managed device will not be able to authnticate with Panorama. This can be done manually through the firewall web interface or through bootstrapping as part of the bootstrap.xml file.