How to Generate a CSR (Certificate Signing Request) & Import the Signed Certificate in Palo Alto

Environment

  • PAN-OS 7.1 and above.
  • Palo Alto Firewall.

Resolution

PAN-OS includes a feature to create a Certificate Signing Request (CSR). This feature can create a Certificate Signing Request (CSR) for sending to a public third-party Certificate Authority like Verisign, Globalsign, Entrust, and so on…

Steps

Generate the CSR

  1. Go to Device > Certificate Management > Certificates.
    Certificate screen 1 - 7.1.png
  2. Click ‘Generate’ at the bottom of the screen.
Certificate screen 2 - 7.1.png
  1. Fill in the Certificate Name (save this name for later), Common Name (usually the FQDN), and select “External Authority (CSR)” for Signed By.
    Note: Do not select ‘Certificate Authority.’
Certificate screen 3 - 7.1.png
  1. Complete the remaining details such as Country, Organization, and so on. Check with the Certificate Authority (CA) about their requirements for Certificate Attribute formatting and criteria. Click Generate to create the CSR.
     
  2. You should see the confirmation window when this is complete.
Certificate screen 4 - 7.1.png

Export the CSR

You will need to export the CSR to send to a third-party CA for signature:

  1. Click the checkbox next to the Certificate Name or any whitespace on that line to select it.
     

Certificate screen 5 - 7.1.png

Note: Newer PAN-OS will display Export Certificate instead of Export

  1. Click Export or Export Certificate and save the file.
  2. Send the exported CSR to a third-party Certificate Authority. The CA will respond with a signed certificate.

Import the Signed Certificate
 

  1. Note the name, including capitalization, of the certificate to import. (This must match the CSR request from above.)
  2. Click the Import option at the bottom of the screen.
Certificate screen 6 - 7.1.png
  1. In the Import Certificate dialog, type the name of the pending certificate. It must match exactly.
Certificate screen 7 - 7.1.png
  1. Click browse to select the signed certificate received from the Certificate Authority and click OK.
    (Note: Do not click the Import Private Key checkbox as the private key is already on the firewall).
     
  2. Depending on the certificate authority used, it may be necessary to chain the intermediate certificate with the server certificate and import it before completing this step. For more information, refer How to Install a Chained Certificate Signed by a Public CA.
  3. Click OK. The certificate now appears valid and the key checkbox is selected. (CA checkbox will remain empty as it is not valid for this example.)csr.png

A new, third-party signed certificate can now be used for GlobalProtect or any other function.

Ref: How to Generate a CSR (Certificate Signing Request) & Import th… – Knowledge Base – Palo Alto Networks