>
    Strata Copilot
    Renew Forward Trust Certificates
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Cloud Manager
    3. Strata Cloud Manager Getting Started
    4. Configuration: Strata Cloud Manager
    5. Configuration: NGFW and Prisma Access
    6. Configuration: Objects
    7. Certificate Management
    8. Strata Cloud Manager Integration with Next-Gen Trust Security
    9. Renew Forward Trust Certificates
    Download PDF
    Strata Cloud Manager

    Renew Forward Trust Certificates

    Table of Contents

    Renew Forward Trust Certificates

    Renew the forward trust issuer certificates at a location before they expire, and bring unmanaged certificates under Next-Gen Trust Security management.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Secure-Flex Credits
    • One of these roles for Strata Cloud Manager Shared Services: Security Administrator, Superuser
    • A Forward Trust Proxy issuer configuration in Next-Gen Trust Security for each key algorithm you use, created by your PKI administrator
    Renew forward trust certificates before they expire to prevent outages or bring existing unmanaged certificates under management by Next-Gen Trust Security and assign an issuer configuration to them.
    Renew all the certificates at a location together so their expiration dates stay aligned. Each certificate's validity period comes from its issuer configuration. Staggered expiration dates at one location are harder to track and give you more chances to miss one.
    1. Select InsightsSecurityNetwork Trust Security.
    2. Select Forward Trust.
    3. Select the configurations to renew, then click Renew.
    4. In Renew Certificates, clear the checkbox for any certificate you don't want to renew.
    5. Next to each certificate, confirm the Status to see if it is ready:
      • Auto Configured: Next-Gen Trust Security assigned an issuer configuration; edit if needed.
      • Action Needed: Next-Gen Trust Security didn't generate this certificate, so it needs an issuer configuration.
      • No Action Needed: This is an untrusted certificate. Strata Cloud Manager reissues it locally without an issuer configuration.
    6. In Status, for each certificate to edit, click Edit certificate and update the following:
      • For Issuer Configuration, keep the assigned issuer or choose a different one.
      • Confirm the Common Name or enter a new one.
      • Confirm Key Type and the validity period, which are read-only and defined by the issuer configuration.
      Edit one certificate at a time until each shows Auto Configured or User Configured.
    7. Click Assign and Renew.
      Assign and Renew is disabled until every selected certificate is ready.
    8. Click Push Config to send the renewed certificates to your firewalls.

    © 2026 Palo Alto Networks, Inc. All rights reserved.